Atomic Red T1543.003

Invoke-AtomicTest T1543.003

Executes the atomic test for service persistence (T1543.003) with Atomic Red Team, validating detection of service creation by the attacker.

Run it in the purple team lab when you want to validate detection of service persistence: the T1543.003 atomic creates a Windows service (sc create) and the team checks what was detected — Event 7045/4697 (service created), Sysmon Event 1 (sc.exe), SIEM rules. It's the validation of service creation detection: the attacker's classic persistence. In purple teaming, the atomic validates service rules and the result feeds the matrix.

Do not run it in production: service creation is a real change on the test host — the lab is the place, and the service is removed at the end (cleanup). The noise is planned. And note: the atomic validates the sc create variant — other paths (PowerShell, installing the service with a binary) have other atomics; coverage is validated per variant. Detection of Event 7045 and the process (sc.exe) are the validated layers; without them, the attacker's persistence service is created without a trace.