System Services: Systemctl
- ID
- T1569.003
- Tactics
- TA0002 Execution
- Sub-technique of
- T1569 System Services
- Platforms
- Linux
- Data sources
- Command Execution, File Modification, Process Creation, Service Creation
- Source
- attack.mitre.org
- MITRE last modified
- 16 Apr 2025
Adversaries may abuse systemctl to execute commands or programs. Systemctl is the primary interface for systemd, the Linux init system and service manager. Typically invoked from a shell, Systemctl can also be integrated into scripts or applications.
Adversaries may use systemctl to execute commands or programs as Systemd Services. Common subcommands include: systemctl start, systemctl stop, systemctl enable, systemctl disable, and systemctl status.[1]
Detection
- DET0073 Detection Strategy for System Services: Systemctl
Data components: Command Execution, File Modification, Process Creation, Service Creation
Mitigations (1)
- M1018 User Account Management
Limit user access to
systemctlto only users who have a legitimate need.