T1543.004 Launch Daemon — ATT&CK Technique

Activity timeline

T1543.004 first appeared in tracked threats on 2026-05-06 and was most recently reported on 2026-09-16. The busiest month was 2026-08 with 7 reports, and 14 of the 14 threats were reported in the twelve months to 2026-09.

How adversaries use it

T1543.004 Launch Daemon is catalogued by MITRE ATT&CK under the Persistence and Privilege Escalation tactics in the Enterprise matrix, as a sub-technique of T1543 Create or Modify System Process. Threadlinqs maps 14 of 2623 tracked threats (0.5%) to it; by severity that is 2 critical, 11 high, 1 medium.

Threats that use T1543.004 most often also use T1059.004 Unix Shell (12 threats), T1005 Data from Local System (11 threats), T1082 System Information Discovery (11 threats), T1027 Obfuscated Files or Information (10 threats), T1036.005 Match Legitimate Resource Name or Location (10 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed.

Mitigations

MITRE ATT&CK lists 2 mitigations for T1543.004.

Data sources

Telemetry that can reveal T1543.004, per MITRE ATT&CK.

Command — Command Execution
File — File Creation, File Modification
Process — Process Creation
Service — Service Creation, Service Modification

Tracked threats

14 tracked threats use T1543.004.

Related CVEs

CVEs referenced by the tracked threats that use T1543.004, most frequent first.

Detection coverage

Threadlinqs maintains 35 detection rules mapped to T1543.004 (SPL 15, KQL 7, Sigma 13). Rule content is available to Blue tier accounts and above; this page shows counts only.

35 detection rules (SPL/KQL/Sigma) · Blue and above. Compare plans

Parent technique

T1543 Create or Modify System Process — 232 tracked threats at the technique level.