tfMITRE ATT&CK sub-technique

Systemd Service T1543.002

sub-technique of T1543 Create or Modify System Process

Tactics: Persistence, Privilege Escalation
Platform: Linux
Version: 1.6
Created: 17 January 2020
Last modified: 12 May 2026
Contributors: Tony Lambert, Red Canary; Emad Al-Mousa, Saudi Aramco; Tim (Wadhwa-)Brown; Ruben Groenewoud (@RFGroenewoud)

Adversaries may create or modify systemd services to repeatedly execute malicious payloads as part of persistence. Systemd is a system and service manager commonly used for managing background daemon processes (also known as services) and other system resources.[1] Systemd is the default initialization (init) system on many Linux distributions replacing legacy init systems, including SysVinit and Upstart, while remaining backwards compatible.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groups70th pct

Threat groups70th percentile · 70% of ATT&CK techniques have this many threat groups attributed or fewer.

Campaigns72nd pct

Campaigns72nd percentile · 72% of ATT&CK techniques have this many campaigns recorded or fewer.

Tools & malwareTop 24%

Tools & malware76th percentile · 76% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rules60th pct

Detection rules60th percentile · 60% of ATT&CK techniques have this many detection rules written or fewer.

Systemd Service MITRE reference T1543.002

70th pctamong all ATT&CK techniques for number of groups

4 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

TeamPCPG1056 ↗

Has used the systemd user service for malware persistence in targeted environments.1

created 2026-07-161 referenceaka PCPCat

Scattered SpiderG1015 ↗

Has run SYSTEMD_UNIT_PATH="/lib/systemd/ system/teleport.service to establish persistence for the Teleport remote access tool.1

created 2023-07-051 referenceaka Roasted 0ktapus

TeamTNTG0139 ↗

Has established persistence through the creation of a cryptocurrency mining system service using systemctl.1 2

created 2021-10-012 references

RockeG0106 ↗

Has installed a systemd service script to maintain persistence.1

created 2020-05-261 reference

All 4 groups for this technique

1 campaign has been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.

2022 Ukraine Electric Power AttackC0034 ↗

During the 2022 Ukraine Electric Power Attack, Sandworm Team configured Systemd to maintain persistence of GOGETTER, specifying the WantedBy=multi-user.target configuration to run GOGETTER when the system begins accepting user logins.1

2022

All 1 campaigns for this technique

11 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.

Mini Shai-HuludS9043 ↗

Has created .service files using Systemd on victim Linux hosts to establish persistence.1 2 3

created 2026-07-29MALWAREcarried by 1 group

TeamPCP Cloud StealerS9041 ↗

Can create a systemd unit to execute a python script for persistence.1 2 3

created 2026-07-01MALWAREcarried by 1 group

Shai-HuludS9008 ↗

Has stopped systemd-resolved in order to manipulate DNS and firewalls.1

created 2026-04-09MALWARE

RIFLESPINES1222 ↗

Can create a systemd service file for execution.1

created 2025-06-12MALWAREcarried by 1 group

GomirS1198 ↗

Creates a systemd service named syslogd for persistence.1

created 2025-01-17MALWAREcarried by 1 group

RotaJakiroS1078 ↗

Depending on the Linux distribution and when executing with root permissions, RotaJakiro may install persistence using a .service file under the /lib/systemd/system/ folder.1

created 2023-06-14MALWAREcarried by 1 group

All 11 software entries for this technique · 6 newest in this preview

Offense vs defense T1543.002

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 1Sigma rules (cumulative) · 4Splunk ESCU (cumulative) · 0

first rule: 2019 Q3 · 1 of 1 campaigns plotted

Systemd Service detection strategy DET0253

MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detection of Systemd Service Creation or Modification on Linux

Enterprise

1 platform

AN0701 · Linux

Detects the creation or modification of .service unit files in system/user-level directories, combined with execution of systemctl, service, or dynamically created drop-ins via systemd generators. Detects persistence by analyzing the ExecStart path, file entropy, and symlink usage, especially when paired with execution from /tmp, /dev/shm, or unmounted volumes.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	auditd:SYSCALL	fork/exec of service via PID 1 (systemd)
File CreationDC0039	auditd:SYSCALL	write, open, or rename to /etc/systemd/system/*.service
Service CreationDC0060	linux:osquery	newly registered unit file with ExecStart pointing to unknown binary
File ModificationDC0061	auditd:SYSCALL	modification of existing .service file
Command ExecutionDC0064	auditd:SYSCALL	execution of systemctl or service with enable/start parameters

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
ServicePathRegex	Regex filters for systemd unit locations (e.g., `/etc/systemd/system/*.service`, `/lib/systemd/system/`)
ExecStartPathAllowlist	Allowlist of trusted `ExecStart` binary paths (e.g., `/usr/bin/`, `/bin/`)
UserContextFilter	List of usernames that are authorized to define user-level services
FileEntropyThreshold	Entropy level of binaries referenced in `ExecStart` to detect packed or obfuscated payloads
SystemctlOperationSet	Flags suspicious combinations such as `systemctl enable` + `systemctl start` within short interval

Limit Software InstallationM1033

Restrict software installation to trusted repositories only and be cautious of orphaned software packages.

Privileged Account ManagementM1026

The creation and modification of systemd service unit files is generally reserved for administrators such as the Linux root user and other users with superuser privileges.

Restrict File and Directory PermissionsM1022

Restrict read/write access to systemd unit files to only select privileged users who have a legitimate need to manage system services.

User Account ManagementM1018

Limit user access to system utilities such as systemctl to only users who have a legitimate need.

Tests3Executorsbash 2 · sh 1Need elevation3 of 3Have prerequisites1Have cleanup3Platformslinux

Test

Platform

Executor

Elevation

Prereqs

Cleanup

Ref

Create Systemd Service

linux

bash

Required

—

Yes

This test creates a Systemd service unit file and enables it as a service.

Input arguments

Name	Type	Default	Description
execstop_action	string	/bin/touch /tmp/art-systemd-execstop-marker	ExecStop action for Systemd service
execstart_action	string	/bin/touch /tmp/art-systemd-execstart-marker	ExecStart action for Systemd service
execreload_action	string	/bin/touch /tmp/art-systemd-execreload-marker	ExecReload action for Systemd service
execstartpre_action	string	/bin/touch /tmp/art-systemd-execstartpre-marker	ExecStartPre action for Systemd service
execstoppost_action	string	/bin/touch /tmp/art-systemd-execstoppost-marker	ExecStopPost action for Systemd service
execstartpost_action	string	/bin/touch /tmp/art-systemd-execstartpost-marker	ExecStartPost action for Systemd service
systemd_service_file	string	art-systemd-service.service	File name of systemd service unit file
systemd_service_path	path	/etc/systemd/system	Path to systemd service unit file

Attack command

echo "[Unit]" > #{systemd_service_path}/#{systemd_service_file}
echo "Description=Atomic Red Team Systemd Service" >> #{systemd_service_path}/#{systemd_service_file}
echo "" >> #{systemd_service_path}/#{systemd_service_file}
echo "[Service]" >> #{systemd_service_path}/#{systemd_service_file}
echo "Type=simple"
echo "ExecStart=#{execstart_action}" >> #{systemd_service_path}/#{systemd_service_file}
echo "ExecStartPre=#{execstartpre_action}" >> #{systemd_service_path}/#{systemd_service_file}
echo "ExecStartPost=#{execstartpost_action}" >> #{systemd_service_path}/#{systemd_service_file}
echo "ExecReload=#{execreload_action}" >> #{systemd_service_path}/#{systemd_service_file}
echo "ExecStop=#{execstop_action}" >> #{systemd_service_path}/#{systemd_service_file}
echo "ExecStopPost=#{execstoppost_action}" >> #{systemd_service_path}/#{systemd_service_file}
echo "" >> #{systemd_service_path}/#{systemd_service_file}
echo "[Install]" >> #{systemd_service_path}/#{systemd_service_file}
echo "WantedBy=default.target" >> #{systemd_service_path}/#{systemd_service_file}
systemctl daemon-reload
systemctl enable #{systemd_service_file}
systemctl start #{systemd_service_file}

Cleanup command

systemctl stop #{systemd_service_file}
systemctl disable #{systemd_service_file}
rm -rf #{systemd_service_path}/#{systemd_service_file}
systemctl daemon-reload

GUID32916385-f063-4b1c-a155-c6d2a5107335

Create SysV Service

linux

Required

—

Yes

This test creates a SysV service unit file and enables it as a service.

Input arguments

Name	Type	Default	Description
rc_service_file	string	art-test	File name of rc service file
rc_service_path	path	/usr/local/etc/rc.d	Path to rc service file

Attack command

echo '#\!/bin/sh' > #{rc_service_path}/#{rc_service_file}
echo ' ' >> #{rc_service_path}/#{rc_service_file}
echo '#' >> #{rc_service_path}/#{rc_service_file}
echo '# PROVIDE: art-test' >> #{rc_service_path}/#{rc_service_file}
echo '# REQUIRE: LOGIN' >> #{rc_service_path}/#{rc_service_file}
echo '# KEYWORD: shutdown' >> #{rc_service_path}/#{rc_service_file}
echo ' ' >> #{rc_service_path}/#{rc_service_file}
echo '. /etc/rc.subr' >> #{rc_service_path}/#{rc_service_file}
echo ' ' >> #{rc_service_path}/#{rc_service_file}
echo 'name="art_test"' >> #{rc_service_path}/#{rc_service_file}
echo 'rcvar=art_test_enable' >> #{rc_service_path}/#{rc_service_file}
echo 'load_rc_config ${name}' >> #{rc_service_path}/#{rc_service_file}
echo 'command="/usr/bin/touch"' >> #{rc_service_path}/#{rc_service_file}
echo 'start_cmd="art_test_start"' >> #{rc_service_path}/#{rc_service_file}
echo '' >> #{rc_service_path}/#{rc_service_file}
echo 'art_test_start()' >> #{rc_service_path}/#{rc_service_file}     
echo '{' >> #{rc_service_path}/#{rc_service_file}
echo '  ${command} /tmp/art-test.marker' >> #{rc_service_path}/#{rc_service_file}
echo '}' >> #{rc_service_path}/#{rc_service_file}
echo ' ' >> #{rc_service_path}/#{rc_service_file}     
echo 'run_rc_command "$1"' >> #{rc_service_path}/#{rc_service_file}
chmod +x #{rc_service_path}/#{rc_service_file}
service art-test enable
service art-test start

Cleanup command

sysrc -x art_test_enable
rm -f #{rc_service_path}/#{rc_service_file}

GUID360f7154-28f2-4931-ad9e-8fcc855cc703

Create Systemd Service file, Enable the service , Modify and Reload the service.

linux

bash

Required

Yes

This test creates a systemd service unit file and enables it to autostart on boot. Once service is created and enabled, it also modifies this same service file showcasing both Creation and Modification of system process.

Attack command

echo "#!/bin/bash" > /etc/init.d/T1543.002
echo "### BEGIN INIT INFO" >> /etc/init.d/T1543.002
echo "# Provides : Atomic Test T1543.002" >> /etc/init.d/T1543.002
echo "# Required-Start: \$all" >> /etc/init.d/T1543.002
echo "# Required-Stop : " >> /etc/init.d/T1543.002
echo "# Default-Start: 2 3 4 5" >> /etc/init.d/T1543.002
echo "# Default-Stop: " >> /etc/init.d/T1543.002
echo "# Short Description: Atomic Test for Systemd Service Creation" >> /etc/init.d/T1543.002
echo "### END INIT INFO" >> /etc/init.d/T1543.002
echo "python3 -c \"import os, base64;exec(base64.b64decode('aW1wb3J0IG9zCm9zLnBvcGVuKCdlY2hvIGF0b21pYyB0ZXN0IGZvciBDcmVhdGluZyBTeXN0ZW1kIFNlcnZpY2UgVDE1NDMuMDAyID4gL3RtcC9UMTU0My4wMDIuc3lzdGVtZC5zZXJ2aWNlLmNyZWF0aW9uJykK')) \" " >> /etc/init.d/T1543.002
chmod +x /etc/init.d/T1543.002
if [ $(cat /etc/os-release | grep -i ID=ubuntu) ] || [ $(cat /etc/os-release | grep -i ID=kali) ]; then update-rc.d T1543.002 defaults; elif [ $(cat /etc/os-release | grep -i 'ID="centos"') ]; then chkconfig T1543.002 on ; else echo "Please run this test on Ubnutu , kali OR centos" ; fi
systemctl enable T1543.002
systemctl start T1543.002
echo "python3 -c \"import os, base64;exec(base64.b64decode('aW1wb3J0IG9zCm9zLnBvcGVuKCdlY2hvIGF0b21pYyB0ZXN0IGZvciBtb2RpZnlpbmcgYSBTeXN0ZW1kIFNlcnZpY2UgVDE1NDMuMDAyID4gL3RtcC9UMTU0My4wMDIuc3lzdGVtZC5zZXJ2aWNlLm1vZGlmaWNhdGlvbicpCg=='))\"" | sudo tee -a /etc/init.d/T1543.002
systemctl daemon-reload
systemctl restart T1543.002

Cleanup command

systemctl stop T1543.002
systemctl disable T1543.002
rm -rf /etc/init.d/T1543.002
systemctl daemon-reload

Prerequisite

System must be Ubuntu ,Kali OR CentOS.

Check

if [ $(cat /etc/os-release | grep -i ID=ubuntu) ] || [ $(cat /etc/os-release | grep -i ID=kali) ] || [ $(cat /etc/os-release | grep -i 'ID="centos"') ]; then exit /b 0; else exit /b 1; fi;

Satisfy

echo Please run from Ubuntu ,Kali OR CentOS.

GUID06e7d3d3-39eb-4649-bf9a-62568fddd378

Tests from Atomic Red Team (MIT licence) · technique definition

Systemd Service detections T1543.002

4 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

60th pctamong all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs