MITRE ATT&CKsub-technique

T1543.002 Systemd Service

Published 2020-01-17 Modified 2026-05-12 Official page ↗
Domain
enterprise
Tactics
Persistence, Privilege Escalation
Platforms
Linux
Version
1.6
Created
2020-01-17

Description

Adversaries may create or modify systemd services to repeatedly execute malicious payloads as part of persistence. Systemd is a system and service manager commonly used for managing background daemon processes (also known as services) and other system resources. Systemd is the default initialization (init) system on many Linux distributions replacing legacy init systems, including SysVinit and Upstart, while remaining backwards compatible. Systemd utilizes unit configuration files with the `.service` file extension to encode information about a service's process. By default, system level unit files are stored in the `/systemd/system` directory of the root owned directories (`/`). User level unit files are stored in the `/systemd/user` directories of the user owned directories (`$HOME`). Inside the `.service` unit files, the following directives are used to execute commands: • `ExecStart`, `ExecStartPre`, and `ExecStartPost` directives execute when a service is started manually by `systemctl` or on system start if the service is set to automatically start. • `ExecReload` directive executes when a service restarts. • `ExecStop`, `ExecStopPre`, and `ExecStopPost` directives execute when a service is stopped. Adversaries have created new service files, altered the commands a `.service` file’s directive executes, and modified the user directive a `.service` file executes as, which could result in privilege escalation. Adversaries may also place symbolic links in these directories, enabling systemd to find these payloads regardless of where they reside on the filesystem. The `.service` file’s User directive can be used to run service as a specific user, which could result in privilege escalation based on specific user/group permissions. Systemd services can be created via systemd generators, which support the dynamic generation of unit files. Systemd generators are small executables that run during boot or configuration reloads to dynamically create or modify systemd unit files by converting non-native configurations into services, symlinks, or drop-ins (i.e., Boot or Logon Initialization Scripts).

Related

Subtechnique of · MITRE ATT&CK (1)

  • T1543 Create or Modify System Process technique

Tactic · MITRE ATT&CK (2)

  • TA0003 Persistence tactic
  • TA0004 Privilege Escalation tactic

Referenced by MITRE ATT&CK · mitigates (4)

  • M1033 Limit Software Installation mitigation
  • M1018 User Account Management mitigation
  • M1022 Restrict File and Directory Permissions mitigation
  • M1026 Privileged Account Management mitigation

Referenced by MITRE ATT&CK · uses (16)

  • S9043 Mini Shai-Hulud software (malware)
  • G1056 TeamPCP group
  • S9041 TeamPCP Cloud Stealer software (malware)
  • S9008 Shai-Hulud software (malware)
  • S1222 RIFLESPINE software (malware)
  • S1198 Gomir software (malware)
  • C0034 2022 Ukraine Electric Power Attack campaign
  • G1015 Scattered Spider group
  • S1078 RotaJakiro software (malware)
  • S0663 SysUpdate software (malware)
  • G0139 TeamTNT group
  • S0601 Hildegard software (malware)
  • G0106 Rocke group
  • S0410 Fysbis software (malware)
  • S0401 Exaramel for Linux software (malware)
  • S0192 Pupy software (tool)

Referenced by Compliance · mitigates (17)

  • CIS-6.8 Define and Maintain Role-Based Access Control CIS Safeguard v8.1
  • NIST-AC-2 Account Management NIST 800-53 control
  • NIST-AC-3 Access Enforcement NIST 800-53 control
  • NIST-AC-5 Separation of Duties NIST 800-53 control
  • NIST-AC-6 Least Privilege NIST 800-53 control
  • NIST-CA-7 Continuous Monitoring NIST 800-53 control
  • NIST-CM-11 User-installed Software NIST 800-53 control
  • NIST-CM-2 Baseline Configuration NIST 800-53 control
  • NIST-CM-3 Configuration Change Control NIST 800-53 control
  • NIST-CM-5 Access Restrictions for Change NIST 800-53 control
  • NIST-CM-6 Configuration Settings NIST 800-53 control
  • NIST-IA-2 Identification and Authentication (Organizational Users) NIST 800-53 control
  • NIST-SA-22 Unsupported System Components NIST 800-53 control
  • NIST-SI-16 Memory Protection NIST 800-53 control
  • NIST-SI-3 Malicious Code Protection NIST 800-53 control
  • NIST-SI-4 System Monitoring NIST 800-53 control
  • NIST-SI-7 Software, Firmware, and Information Integrity NIST 800-53 control

References