T1053.006sub-technique of T1053 Scheduled Task/Job
Systemd Timers
Linux1 piece on this siteT1053.006 on attack.mitre.org
Adversaries may abuse systemd timers to perform task scheduling for initial or recurring execution of malicious code. Systemd timers are unit files with file extension `.timer` that control services. Timers can be set to run on a calendar event or after a time span relative to a starting point. They can be used as an alternative to Cron in Linux environments.
If this is happening now
Checklists and playbooks to open while the alert is still live.
Playbook for this stage
Suspicious execution on an endpoint
An EDR alert, an unexplained process, or a user reporting something odd.
Playbook for this stage
Cloud account compromise
Impossible travel, an unrecognised inbox rule, or a reported invoice-fraud attempt.
The evidence it leaves
Where the traces live, and what each source proves and does not.
Artifact reference
systemd units and timers
T1053.006
how MITRE says to see it
Behavioral Detection of Systemd Timer Abuse for Scheduled Execution
- Detects adversarial abuse of systemd timers by correlating file creation/modification of.timer and.service units in system directories with the execution of abnormal child processes launched by 'systemd' (PID 1), especially as root.
what reduces it
- M1018 User Account Management. Limit user access to system utilities such as 'systemctl' or 'systemd-run' to users who have a legitimate need.
- M1022 Restrict File and Directory Permissions. Restrict read/write access to systemd `.timer` unit files to only select privileged users who have a legitimate need to manage system services.
- M1026 Privileged Account Management. Limit access to the root account and prevent users from creating and/or modifying systemd timer unit files.