Systemd Service

What the technique is

Adversaries may create or modify systemd services to repeatedly execute malicious payloads as part of persistence. Systemd is a system and service manager commonly used for managing background daemon processes (also known as services) and other system resources. Systemd is the default initialization (init) system on many Linux distributions replacing legacy init systems, including SysVinit and Upstart, while remaining backwards compatible. Systemd utilizes unit configuration files with the.service file extension to encode information about a service's process. By default, system level unit files are stored in the /systemd/system directory of the root owned directories (/). User level unit files are stored in the /systemd/user directories of the user owned directories ($HOME). Inside the.service unit files, the following directives are used to execute commands: ExecStart, ExecStartPre, and ExecStartPost directives execute when a service is started manually by systemctl or on system start if the service is set to automatically start. ExecReload directive executes when a service restarts. ExecStop, ExecStopPre, and ExecStopPost directives execute when a service is stopped. Adversaries have created new service files, altered the commands a.service file’s directive executes, and modified the user directive a.service file executes as, which could result in privilege escalation. […]

What MITRE says you would watch

• AN0701

  Detects the creation or modification of.service unit files in system/user-level directories, combined with execution of systemctl, service, or dynamically created drop-ins via systemd generators. Detects persistence by analyzing the ExecStart path, file entropy, and symlink usage, especially when paired with execution from /tmp, /dev/shm, or unmounted volumes.