T1053.006 — Systemd Timers

Tactics: Execution, Persistence, Privilege Escalation · Platforms: Linux

Adversaries may abuse systemd timers to perform task scheduling for initial or recurring execution of malicious code. Systemd timers are unit files with file extension .timer that control services. Timers can be set to run on a calendar event or after a time span relative to a starting point. They…

Sub-technique of Scheduled Task/Job (T1053).

Sigma detection rules (1)

T1053.006 Scheduled Task/Job: Systemd Timers

title: "T1053.006 Scheduled Task/Job: Systemd Timers"
id: 6a1fb4ac-45e6-4593-b2a5-d810d2982bca
description: 'Behavioral Detection of Systemd Timer Abuse for Scheduled Execution, now covering both privileged system-level timer paths and the user-level persistence path (~/.config/systemd/user/) that the technique explicitly documents. (Retargeted to the file_event auditd telemetry that actually captures this techniques behavior; see logsource below.) Tune using: TimerIntervalThreshold, ParentProcessID, UserContext, TimerCreationPath. Pairing a .timer with its required same-basename .service unit is not implemented as a Sigma correlation here -- group-by requires an identical field value across both events and the .timer/.service basenames never match verbatim -- so that check should be done via an external hunt query joining PATH events on the shared basename.'
references:
  - https://attack.mitre.org/techniques/T1053/006
author: Shahrukh Khan
date: 2026-03-14
license: MIT
tags:
  - attack.execution
  - attack.persistence
  - attack.privilege-escalation
  - attack.t1053.006

logsource:
  category: file_event
  product: linux

detection:
  selection_privileged:
    type: PATH
    name|endswith: '.timer'
    name|startswith:
      - '/etc/systemd/system/'
      - '/usr/lib/systemd/system/'
      - '/lib/systemd/system/'
    nametype: CREATE
  selection_user:
    type: PATH
    name|endswith: '.timer'
    name|contains: '/.config/systemd/user/'
    nametype: CREATE
  condition: 1 of selection_*

falsepositives:
  - Legitimate software installation or system administration creating systemd timers for routine maintenance tasks, including user-level timers intentionally created by a logged-in user for personal cron-like jobs.

level: medium

Related sub-techniques

Explore