AN0701 Analytic 0701

Linux · attack.mitre.org · ATT&CK Enterprise v19.2

<p>Detects the creation or modification of .service unit files in system/user-level directories, combined with execution of systemctl, service, or dynamically created drop-ins via systemd generators. Detects persistence by analyzing the ExecStart path, file entropy, and symlink usage, especially when paired with execution from /tmp, /dev/shm, or unmounted volumes.</p>

Detects: T1543.002 Systemd Service
Part of: DET0253 Detection of Systemd Service Creation or Modification on Linux

Log sources and channels

Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.

Log source	Channel	Data component
auditd:SYSCALL	`write, open, or rename to /etc/systemd/system/*.service`	DC0039 File Creation
auditd:SYSCALL	`modification of existing .service file`	DC0061 File Modification
auditd:SYSCALL	`execution of systemctl or service with enable/start parameters`	DC0064 Command Execution
auditd:SYSCALL	`fork/exec of service via PID 1 (systemd)`	DC0032 Process Creation
linux:osquery	`newly registered unit file with ExecStart pointing to unknown binary`	DC0060 Service Creation

Mutable elements

Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.

Field	Description
`ServicePathRegex`	Regex filters for systemd unit locations (e.g., `/etc/systemd/system/*.service`, `/lib/systemd/system/`)
`ExecStartPathAllowlist`	Allowlist of trusted `ExecStart` binary paths (e.g., `/usr/bin/`, `/bin/`)
`UserContextFilter`	List of usernames that are authorized to define user-level services
`FileEntropyThreshold`	Entropy level of binaries referenced in `ExecStart` to detect packed or obfuscated payloads
`SystemctlOperationSet`	Flags suspicious combinations such as `systemctl enable` + `systemctl start` within short interval