Techniques › T1036.004 › AN0325
AN0325 Analytic 0325
Linux · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Creation or modification of
systemd service units or cron jobs using deceptive naming and untrusted command paths, often followed by lateral network activity or privilege escalation.</p>- Detects
- T1036.004 Masquerade Task or Service
- Part of
- DET0117 Detection of Masqueraded Tasks or Services with Suspicious Naming and Execution
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| auditd:CONFIG_CHANGE | /var/log/audit/audit.log | DC0012 Scheduled Job Modification |
| linux:osquery | scheduled/real-time | DC0041 Service Metadata |
| linux:cron | cron activity | DC0005 Scheduled Job Metadata |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
UnitFilePath | Unusual or user-space paths for systemd unit files |
ServiceNameDeviation | Detect units with names similar to legitimate ones (e.g., `networks.service` instead of `network.service`) |
ExecStartPath | Track uncommon or suspicious binaries in `ExecStart=` directives |