Systemd timer enabled or scheduled from the command line

Siemphony@siemphonylowT1053.006unverified

Matches the execution leg of AN0645: a process creation for `systemctl` whose command line names a `.timer` unit, or for `systemd-run` carrying one of the transient-timer options that schedule a unit without any unit file existing on disk at all. The process-creation source is chosen over the same analytic's auditd file-creation leg because activation is the step both variants share — a `.timer` file written under /etc/systemd/system does nothing until systemd is told about it — and because the file leg would record `name=` exactly as it was passed to the syscall, so a write from inside the directory logs a bare unit name with the directory on an unjoinable CWD record. Two of MITRE's knobs cannot be applied inside a single event: `TimerIntervalThreshold` asks whether the interval is unusually short, and comparing `--on-active=30s` against a threshold is arithmetic Sigma has no operator for, so only the presence of the flag is matched; `ParentProcessID` (parent PID 1, i.e. the payload systemd later runs) is a second event that Sigma cannot join to this one. The knobs `UserContext` and `TimerCreationPath` are deliberately not used as filters here, because user-level timers under ~/.config/systemd/user are in scope for the technique and filtering to root would drop them. The rule is also evadable by design of the mechanism: an operator who writes the unit file and symlinks it into timers.target.wants by hand, rather than calling `systemctl enable`, produces no matching command line, and a timer whose name does not end in `.timer` is not valid systemd, but `systemctl start foo` on the paired service is not matched either. Prerequisite, and it has two halves. The rule is written in the normalised Linux `process_creation` vocabulary, where `Image` and `CommandLine` arrive on one document — Sysmon for Linux EventID 1, or an auditd shipper such as auditbeat or Elastic's auditd module that reassembles the records. Raw auditd shipped as `product: linux / service: auditd` cannot satisfy this rule at all: there the binary is `exe` on the SYSCALL record and the arguments are `a0`/`a1` on a separate EXECVE record, so no single record carries both halves of either selection and the AND is never true. That feed needs the two records joined into one event before this rule matches, not more auditing. Second half: none of these sources record execve by default, so with an auditd-based shipper the rule returns zero rows until a rule such as `-a always,exit -F arch=b64 -S execve -k exec` is loaded, and zero rows reads as quiet when it actually means blind. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0231, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where ((FolderPath endswith "/systemctl" and ProcessCommandLine contains ".timer") or (FolderPath endswith "/systemd-run" and (ProcessCommandLine contains "--on-active" or ProcessCommandLine contains "--on-boot" or ProcessCommandLine contains "--on-startup" or ProcessCommandLine contains "--on-unit-active" or ProcessCommandLine contains "--on-unit-inactive" or ProcessCommandLine contains "--on-calendar" or ProcessCommandLine contains "--timer-property")))

Splunk · SPL

Run this as a search.

index=* ((Image="*/systemctl" AND CommandLine="*.timer*") OR (Image="*/systemd-run" AND (CommandLine="*--on-active*" OR CommandLine="*--on-boot*" OR CommandLine="*--on-startup*" OR CommandLine="*--on-unit-active*" OR CommandLine="*--on-unit-inactive*" OR CommandLine="*--on-calendar*" OR CommandLine="*--timer-property*")))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE ((TO_LOWER(process.executable) LIKE "*/systemctl" AND TO_LOWER(process.command_line) LIKE "*.timer*") OR (TO_LOWER(process.executable) LIKE "*/systemd-run" AND (TO_LOWER(process.command_line) LIKE "*--on-active*" OR TO_LOWER(process.command_line) LIKE "*--on-boot*" OR TO_LOWER(process.command_line) LIKE "*--on-startup*" OR TO_LOWER(process.command_line) LIKE "*--on-unit-active*" OR TO_LOWER(process.command_line) LIKE "*--on-unit-inactive*" OR TO_LOWER(process.command_line) LIKE "*--on-calendar*" OR TO_LOWER(process.command_line) LIKE "*--timer-property*")))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,linux,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <!-- 2 rules: the Sigma condition ORs across different fields,       which one rule cannot express. Any one matching is a hit. -->  <rule id="100000" level="5">    <!-- Set <if_sid> to the decoder/base rule for linux so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)/systemctl$</field>    <field name="CommandLine" type="pcre2">(?i)\.timer</field>    <description>Systemd timer enabled or scheduled from the command line (1/2)</description>    <mitre>      <id>T1053.006</id>    </mitre>  </rule>   <rule id="100001" level="5">    <!-- Set <if_sid> to the decoder/base rule for linux so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)/systemd-run$</field>    <field name="CommandLine" type="pcre2">(?i)(--on-active|--on-boot|--on-startup|--on-unit-active|--on-unit-inactive|--on-calendar|--timer-property)</field>    <description>Systemd timer enabled or scheduled from the command line (2/2)</description>    <mitre>      <id>T1053.006</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / linux
Level: low
Category: persistence_scheduled_task
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: ca74a188-ab07-42e5-8d46-d1dd1238d904

ATT&CKT1053.006

T1053.006Systemd Timers

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessonpersistence scheduled task

persistence scheduled taskAI draft — unreviewed

01 · What this rule detects

One process-creation event: systemctl invoked with .timer somewhere in the command line, or systemd-run carrying a transient-timer flag. AN0645 asks for a correlation — a .timer unit file appearing under /etc/systemd/system, joined to an unusual child of PID 1 — and Sigma cannot join two events. The rule takes the activation step instead, because a unit file on disk does nothing until systemd is told about it, and a transient systemd-run timer never touches disk at all.

02 · Telemetry you need

category: process_creation / product: linux, from AN0645's execve entry. The prerequisite has two halves and both matter. First, vocabulary: this rule needs Image and CommandLine on one document — Sysmon for Linux EventID 1, or an auditd shipper such as auditbeat or Elastic's auditd module that reassembles the records. Raw product: linux / service: auditd cannot match it, because there the binary is exe on a SYSCALL record and the arguments are a0/a1 on a separate EXECVE record, so no single record satisfies the AND inside either selection. That feed needs the records joined, not more auditing. Second, execve is not recorded by default; with an auditd-based shipper you need a rule such as -a always,exit -F arch=b64 -S execve -k exec loaded. Until then the rule returns zero rows, and zero rows reads as quiet when it means blind.

03 · How the logic works

Two selections, OR-ed by 1 of selection*.

The leading slash anchors the binary name rather than matching a path fragment. .timer is the whole discriminator: a systemd timer unit must carry that suffix to be valid, so enable, start and disable all name it.

systemd-run with any of those schedules a unit with no file on disk, which is why a flag list rather than .timer carries this leg. Two of MITRE's knobs have no expression here. TimerIntervalThreshold asks whether the interval is unusually short, and comparing --on-active=30s against five minutes is arithmetic Sigma has no operator for, so only the flag's presence is matched. ParentProcessID — a child with PPID 1 — is the payload systemd later runs, a second event.

04 · Common false positives

The first false positive sets the level. Distribution packages ship timers and enable them from postinst scripts (apt-daily, man-db, logrotate, fwupd-refresh), so every patch window produces matches in volume on a healthy estate. Configuration management is second: Ansible's systemd module, Puppet, Chef and Salt assert timer state by shelling out on every run, changed or not. Third, the rule reads a string, not an action — systemctl status backup.timer and systemctl cat backup.timer match exactly like an enable does, and health-check scripts run them on a schedule. level: low is what that top entry supports; medium would contradict it.

05 · Detection maturity

tier_1: , and it cannot be higher: UNVERIFIED, derived from DET0231 and never executed against a log line.
tier_2: starts by proving the feed — run systemctl status foo.timer on a test host and confirm the event carries Image and CommandLine together — then running read-only through one patch cycle and one config-management convergence and converting the survivors into exclusions.
tier_3: is MITRE's correlation, which needs an engine outside Sigma.

Tuning & false positivesexperimental · 5 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Split the read-only verbs off first. Excluding status, is-active, cat and
MITRE names UserContext and TimerCreationPath as knobs; neither is used as a
Exclude package managers and config-management agents by parent process, not by
Pair it with a file-creation rule on /etc/systemd/system/*.timer and

Declared by the author

Package installation and upgrade. Distribution packages ship their own timers and enable them from postinst scripts — apt-daily.timer, man-db.timer, logrotate.timer, fwupd-refresh.timer and systemd-tmpfiles-clean.timer among them — so every apt or dnf transaction that touches one of those packages runs a matching systemctl command. On a patched estate this is the highest-volume benign source by a wide margin and is why this rule is low rather than medium.
Configuration management convergence. The Ansible systemd and systemd_service modules, Puppet service resources, Chef and Salt all assert timer state by shelling out to systemctl on every run, which produces a match per managed host per run whether or not anything changed.
Read-only inspection by administrators and monitoring agents. The rule reads the image name and the string .timer only, so systemctl status backup.timer, systemctl cat backup.timer and systemctl is-active backup.timer match exactly like an enable does, and health-check scripts run those on a schedule.
Legitimate one-shot scheduling with systemd-run. Administrators and provisioning tooling use systemd-run --on-active=5m to defer a reboot, a package operation or a maintenance script until a session has ended, and installers use --on-calendar to register a first-run maintenance job.
Host build and container provisioning: cloud-init, image bake scripts and Dockerfile-equivalent VM builds enabling the timers a role needs, which produces a burst of matches on every newly created machine.

Noise check0 of 4 fired

Fires on none of the 4 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 4 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1053.006, evaluated against their process_creation events.

Share this rule

/u/siemphony/ca74a188-ab07-42e5-8d46-d1dd1238d904

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Systemd timer enabled or scheduled from the command line

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it