T1543.002 Systemd Service
Sub-technique of T1543 Create or Modify System Process
Adversaries may create or modify systemd services to repeatedly execute malicious payloads as part of persistence. Systemd is a system and service manager commonly used for managing background daemon processes (also known as services) and other system resources.(Citation: Linux man-pages: systemd January 2014) Systemd is the default initialization (init) system on many Linux distributions…
Who uses it · with stories on Jábega
Sigma rules to hunt it
- LiteLLM / TeamPCP Supply Chain Attack Indicatorshighexperimental · linux
- TeamPCP LiteLLM Supply Chain Attack Persistence Indicatorshighexperimental · linux
- Systemd Service Creationmediumtest · linux
Rules from SigmaHQ · Detection Rule License 1.1. Technique from MITRE ATT&CK®.