Techniques › T1053.006 › AN0645
AN0645 Analytic 0645
Linux · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Detects adversarial abuse of systemd timers by correlating file creation/modification of .timer and .service units in system directories with the execution of abnormal child processes launched by 'systemd' (PID 1), especially as root.</p>
- Detects
- T1053.006 Systemd Timers
- Part of
- DET0231 Behavioral Detection of Systemd Timer Abuse for Scheduled Execution
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| auditd:SYSCALL | creat, open, write on /etc/systemd/system and /usr/lib/systemd/system | DC0039 File Creation |
| auditd:SYSCALL | execve logging for /usr/bin/systemctl and systemd-run | DC0032 Process Creation |
| linux:osquery | file_events | DC0001 Scheduled Job Creation |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
TimerIntervalThreshold | The interval threshold used to determine if a newly created timer is unusually frequent or immediate (e.g., < 5 minutes). |
ParentProcessID | Whether the child process has a parent PID of 1, indicating systemd as the invoker. Can be tuned to include known benign cases. |
UserContext | User under which the timer/service is created or executed (e.g., root vs. non-root). |
TimerCreationPath | The path where the timer or service file is created; system-wide vs. user space can be scoped. |