Systemd timers (T1053.006) are a Linux persistence and execution option that MITRE files under Scheduled Task/Job. The tactics are Execution, Persistence and Privilege Escalation, and the platform is Linux.
A timer is a unit file with a .timer extension that controls a service. It can fire on a calendar event or after a time span relative to a starting point. MITRE describes timers as an alternative to cron.
How attackers use it
Each .timer file needs a matching .service file with the same name, so example.timer pairs with example.service. Privileged timers live in /etc/systemd/system/ and /usr/lib/systemd/system. User level timers live in ~/.config/systemd/user/.
That split gives an adversary two options. A timer in a privileged path can hold root level persistence. A timer in the user path gives user level persistence without needing root. MITRE also notes that timers can be activated remotely with systemctl, which operates over SSH.
MITRE's own examples include a service registered for persistence on Kubernetes nodes and a user level service file under the home directory, so both paths are used in practice.
How to detect it
MITRE's analytic correlates two things: creation or modification of .timer and .service units in system directories, and the execution of abnormal child processes launched by systemd (PID 1), especially as root. A new unit file followed by something unfamiliar being started by systemd is the pattern.
How to reduce the risk
- Limit access to the root account and prevent users from creating or modifying timer unit files.
- Restrict read and write access to
.timerfiles to the few privileged users who need to manage system services. - Limit use of
systemctlandsystemd-runto users who have a legitimate need.
Check your own environment
Read-only commands on Linux:
systemctl list-timers --allshows every timer and what it triggers.ls -la /etc/systemd/system/ /usr/lib/systemd/system | grep timerlists privileged timer files.ls -la ~/.config/systemd/user/shows user level units for the current account.
Anything you cannot tie to a package or a known owner deserves a look.
Quick check
Why does a user level timer matter even without root?
It lives under the user's home directory and still gives persistence at that user's privilege level.
Sources
- MITRE ATT&CK: Scheduled Task/Job: Systemd Timers (T1053.006)
