# T1569.003 - System Services: Systemctl

## Description from ATT&CK

> Adversaries may abuse systemctl to execute commands or programs. Systemctl is the primary interface for systemd, the Linux init system and service manager. Typically invoked from a shell, Systemctl can also be integrated into scripts or applications.
> 
> Adversaries may use systemctl to execute commands or programs as [Systemd Service](https://attack.mitre.org/techniques/T1543/002)s. Common subcommands include: `systemctl start`, `systemctl stop`, `systemctl enable`, `systemctl disable`, and `systemctl status`.(Citation: Red Hat Systemctl 2022)

[Source](https://attack.mitre.org/techniques/T1569/003)

## Atomic Tests

- [Atomic Test #1: Create and Enable a Malicious systemd Service Unit](#atomic-test-1-create-and-enable-a-malicious-systemd-service-unit)
- [Atomic Test #2: Create systemd Service Unit from /tmp (Unusual Location)](#atomic-test-2-create-systemd-service-unit-from-tmp-unusual-location)
- [Atomic Test #3: Create systemd Service Unit from /dev/shm (Unusual Location)](#atomic-test-3-create-systemd-service-unit-from-devshm-unusual-location)
- [Atomic Test #4: Modify Existing systemd Service to Execute Malicious Command](#atomic-test-4-modify-existing-systemd-service-to-execute-malicious-command)
- [Atomic Test #5: Execute Command via Transient systemd Service (systemd-run)](#atomic-test-5-execute-command-via-transient-systemd-service-systemd-run)
- [Atomic Test #6: Enumerate All systemd Services Using systemctl](#atomic-test-6-enumerate-all-systemd-services-using-systemctl)
- [Atomic Test #7: Enable systemd Service for Persistence with Auto-Restart](#atomic-test-7-enable-systemd-service-for-persistence-with-auto-restart)
- [Atomic Test #8: Masquerade Malicious Service as Legitimate System Service](#atomic-test-8-masquerade-malicious-service-as-legitimate-system-service)

### Atomic Test #1: Create and Enable a Malicious systemd Service Unit

Creates a new systemd service unit file in /etc/systemd/system/ and enables it using
systemctl enable followed by systemctl start. Adversaries commonly abuse this workflow
to establish persistence or execute arbitrary commands under the context of systemd.

This simulates the full attacker workflow: writing the unit file, reloading the systemd
daemon, enabling the service to survive reboots, and starting it immediately. This is
consistent with techniques observed in ransomware precursor activity and post-exploitation
frameworks targeting Linux infrastructure.

**Supported Platforms:** Linux

**auto_generated_guid:** `e58c8723-5503-4533-b642-535cd20ec648`

#### Inputs

| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| service_name | Name of the malicious service to create | string | atomic-test|
| command_to_run | Command the service will execute | string | /bin/bash -c "echo atomictest > /tmp/atomic_service_output.txt"|

#### Attack Commands: Run with `sh`! Elevation Required (e.g. root or admin)

```sh
echo "[Unit]" > /etc/systemd/system/#{service_name}.service
echo "Description=Atomic Test Service" >> /etc/systemd/system/#{service_name}.service
echo "After=network.target" >> /etc/systemd/system/#{service_name}.service
echo "" >> /etc/systemd/system/#{service_name}.service
echo "[Service]" >> /etc/systemd/system/#{service_name}.service
echo "ExecStart=#{command_to_run}" >> /etc/systemd/system/#{service_name}.service
echo "Restart=on-failure" >> /etc/systemd/system/#{service_name}.service
echo "" >> /etc/systemd/system/#{service_name}.service
echo "[Install]" >> /etc/systemd/system/#{service_name}.service
echo "WantedBy=multi-user.target" >> /etc/systemd/system/#{service_name}.service
systemctl daemon-reload
systemctl enable #{service_name}.service
systemctl start #{service_name}.service
systemctl status #{service_name}.service
```

#### Cleanup Commands

```sh
systemctl stop #{service_name}.service 2>/dev/null || true
systemctl disable #{service_name}.service 2>/dev/null || true
rm -f /etc/systemd/system/#{service_name}.service
systemctl daemon-reload
rm -f /tmp/atomic_service_output.txt
```

#### Dependencies: Run with `sh`!

##### Description: systemctl must be available on the system

###### Check Prereq Commands

```sh
if [ -x "$(command -v systemctl)" ]; then exit 0; else exit 1; fi
```

###### Get Prereq Commands

```sh
echo "systemctl is not available. Ensure systemd is running on this system."
```

##### Description: The test must be run as root or with sudo privileges

###### Check Prereq Commands

```sh
if [ "$(id -u)" -eq 0 ]; then exit 0; else exit 1; fi
```

###### Get Prereq Commands

```sh
echo "This test requires root privileges. Run as root or use sudo."
```

##### Description: /etc/systemd/system/ directory must exist and be writable

###### Check Prereq Commands

```sh
if [ -d "/etc/systemd/system" ] && [ -w "/etc/systemd/system" ]; then exit 0; else exit 1; fi
```

###### Get Prereq Commands

```sh
echo "/etc/systemd/system/ does not exist or is not writable. Ensure systemd is installed."
```

### Atomic Test #2: Create systemd Service Unit from /tmp (Unusual Location)

Creates a systemd service unit file in /tmp and loads it using systemctl start with
an absolute path. Adversaries may write service unit files to world-writable directories
such as /tmp to avoid triggering alerts on new file creation in standard service
directories, or to execute payloads transiently without permanently installing a service.

Loading a service unit from an arbitrary path rather than a standard systemd directory
is unusual behaviour that should be detectable by monitoring systemctl command arguments.

**Supported Platforms:** Linux

**auto_generated_guid:** `a1fa406e-2354-4a24-b6d6-94157e7564d4`

#### Inputs

| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| service_path | Full path to the service file to be written in /tmp | path | /tmp/atomic_tmp.service|
| command_to_run | Command the service will execute | string | /bin/bash -c "id > /tmp/atomic_tmp_output.txt"|

#### Attack Commands: Run with `sh`! Elevation Required (e.g. root or admin)

```sh
echo "[Unit]" > #{service_path}
echo "Description=Atomic Tmp Service" >> #{service_path}
echo "" >> #{service_path}
echo "[Service]" >> #{service_path}
echo "ExecStart=#{command_to_run}" >> #{service_path}
echo "" >> #{service_path}
echo "[Install]" >> #{service_path}
echo "WantedBy=multi-user.target" >> #{service_path}
systemctl link #{service_path}
systemctl start $(basename #{service_path})
systemctl status $(basename #{service_path})
```

#### Cleanup Commands

```sh
systemctl stop $(basename #{service_path}) 2>/dev/null || true
rm -f #{service_path}
rm -f /tmp/atomic_tmp_output.txt
```

#### Dependencies: Run with `sh`!

##### Description: systemctl must be available on the system

###### Check Prereq Commands

```sh
if [ -x "$(command -v systemctl)" ]; then exit 0; else exit 1; fi
```

###### Get Prereq Commands