Techniques › T1569.003 › AN0200
AN0200 Analytic 0200
Linux · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Abuse of systemctl to execute commands or manage systemd services. Defender perspective: correlate suspicious service creation or modification with execution of systemctl subcommands such as start, enable, or status. Detect cases where systemctl is used to load services from unusual locations (e.g., /tmp, /dev/shm) or where new service units are created outside of expected administrative workflows.</p>
- Detects
- T1569.003 Systemctl
- Part of
- DET0073 Detection Strategy for System Services: Systemctl
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| auditd:EXECVE | execution of systemctl with subcommands start, stop, enable, disable | DC0064 Command Execution |
| auditd:SYSCALL | open/write of .service unit files | DC0061 File Modification |
| auditd:EXECVE | systemctl spawning managed processes | DC0032 Process Creation |
| auditd:CONFIG_CHANGE | creation or modification of systemd services | DC0060 Service Creation |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
MonitoredPaths | Paths to monitor for service unit files, typically /etc/systemd/system and /usr/lib/systemd/system. Adversaries may use uncommon locations such as /tmp. |
SuspiciousSubcommands | Focus on systemctl subcommands start, enable, or daemon-reload when used outside expected change windows. |
CorrelationWindow | Time window to correlate service file modification with subsequent systemctl execution. |