t1569-003-systemctl

name	T1569.003_systemctl
description	Adversaries may abuse systemctl to execute commands or programs.
category	input-validation
version	18.1
author	cyberstrike-official
tags	["mitre-attack","enterprise","t1569.003","execution","linux","sub-technique"]
technique_id	T1569.003
tactic	execution
all_tactics	["execution"]
platforms	["Linux"]
mitre_url	https://attack.mitre.org/techniques/T1569/003
tech_stack	["linux"]
cwe_ids	["CWE-94"]
chains_with	["T1569","T1569.001","T1569.002"]
prerequisites	["T1569"]
severity_boost	{"T1569":"Chain with T1569 for deeper attack path","T1569.001":"Chain with T1569.001 for deeper attack path","T1569.002":"Chain with T1569.002 for deeper attack path"}

T1569.003 Systemctl

Sub-technique of: T1569

High-Level Description

Adversaries may abuse systemctl to execute commands or programs. Systemctl is the primary interface for systemd, the Linux init system and service manager. Typically invoked from a shell, Systemctl can also be integrated into scripts or applications.

Adversaries may use systemctl to execute commands or programs as Systemd Services. Common subcommands include: systemctl start, systemctl stop, systemctl enable, systemctl disable, and systemctl status.

Kill Chain Phase

• Execution (TA0002)

Platforms: Linux

What to Check

• Identify if Systemctl technique is applicable to target environment
• Check Linux systems for indicators of Systemctl
• Verify mitigations are bypassed or absent (1 known mitigations)
• Assess detection coverage (1 detection strategies)

How to Test

Atomic Red Team Tests

The following tests are from Atomic Red Team and provide actionable ways to test this technique:

Atomic Test 1: Create and Enable a Malicious systemd Service Unit

Creates a new systemd service unit file in /etc/systemd/system/ and enables it using systemctl enable followed by systemctl start. Adversaries commonly abuse this workflow to establish persistence or execute arbitrary commands under the context of systemd.

This simulates the full attacker workflow: writing the unit file, reloading the systemd daemon, enabling the service to survive reboots, and starting it immediately. This is consistent with techniques observed in ransomware precursor activity and post-exploitation frameworks targeting Linux infrastructure.

Supported Platforms: linux Elevation Required: Yes

echo "[Unit]" > /etc/systemd/system/#{service_name}.service
echo "Description=Atomic Test Service" >> /etc/systemd/system/#{service_name}.service
echo "After=network.target" >> /etc/systemd/system/#{service_name}.service
  >> /etc/systemd/system/#{service_name}.service
  >> /etc/systemd/system/#{service_name}.service
  >> /etc/systemd/system/#{service_name}.service
  >> /etc/systemd/system/#{service_name}.service
  >> /etc/systemd/system/#{service_name}.service
  >> /etc/systemd/system/#{service_name}.service
  >> /etc/systemd/system/#{service_name}.service
systemctl daemon-reload
systemctl  
systemctl start 
systemctl status