Systemctl Abuse on Linux: What to Watch (T1569.003)

On most Linux distributions, systemctl is how services are started, stopped and enabled. MITRE T1569.003, Systemctl, covers adversaries doing the same with their own code. It is an execution technique that applies to Linux.

How attackers use it

Systemctl is the primary interface for systemd, the Linux init system and service manager. It is usually run from a shell but can be called from scripts or applications. MITRE says adversaries use it to execute commands or programs as systemd services, with subcommands such as systemctl start, stop, enable, disable and status.

How to detect it

MITRE's analytic correlates service creation or modification with systemctl subcommands such as start, enable and status. Two things stand out:

• Services loaded from unusual locations, such as /tmp or /dev/shm.
• New service units created outside your normal administrative workflows.

Audit file creation in the systemd unit directories and log systemctl invocations by non-administrators.

How to reduce the risk

MITRE lists user account management: limit access to systemctl to only the users who have a legitimate need. Pair that with tight sudo rules, so that only named people can create or enable units.

Check your own environment

Read-only checks on a Linux host:

systemctl list-unit-files --state=enabled
systemctl list-units --type=service --state=running
ls -la /etc/systemd/system /run/systemd/system
systemctl show -p FragmentPath ssh.service

Compare unit names against what you deploy. For any unit you do not recognize, check where the file lives and what its ExecStart runs. Anything running from a temporary directory deserves a closer look.

Quick check

Sources

• MITRE ATT&CK T1569.003, Systemctl