T1543.002sub-technique of T1543 Create or Modify System Process
Systemd Service
Linux3 pieces on this siteT1543.002 on attack.mitre.org
Adversaries may create or modify systemd services to repeatedly execute malicious payloads as part of persistence. Systemd is a system and service manager commonly used for managing background daemon processes (also known as services) and other system resources. Systemd is the default initialization (init) system on many Linux distributions replacing legacy init systems, including SysVinit and Upstart, while remaining backwards compatible.
If this is happening now
Checklists and playbooks to open while the alert is still live.
Suspicious execution on an endpoint
An EDR alert, an unexplained process, or a user reporting something odd.
Cloud account compromise
Impossible travel, an unrecognised inbox rule, or a reported invoice-fraud attempt.
The evidence it leaves
Where the traces live, and what each source proves and does not.
systemd units and timers
systemd journal
Read
Analyses, case studies, guides, references and interview questions.
linux-triage.sh: a read-only first-hour collection script for Linux
One Bash file that collects processes, sockets, deleted-but-running binaries, logons, SSH keys, persistence and recent changes in order of volatility, using only what ships with a distribution. It writes text files and a SHA-256 manifest, and it is short enough to read before you run it.
how MITRE says to see it
Detection of Systemd Service Creation or Modification on Linux
- Detects the creation or modification of `.service` unit files in system/user-level directories, combined with execution of `systemctl`, `service`, or dynamically created drop-ins via systemd generators.
what reduces it
- M1033 Limit Software Installation. Restrict software installation to trusted repositories only and be cautious of orphaned software packages.
- M1018 User Account Management. Limit user access to system utilities such as `systemctl` to only users who have a legitimate need.
- M1022 Restrict File and Directory Permissions. Restrict read/write access to systemd unit files to only select privileged users who have a legitimate need to manage system services.
- M1026 Privileged Account Management. The creation and modification of systemd service unit files is generally reserved for administrators such as the Linux root user and other users with superuser privileges.