T1543.002 — Systemd Service

Tactics: Persistence, Privilege Escalation · Platforms: Linux

Adversaries may create or modify systemd services to repeatedly execute malicious payloads as part of persistence. Systemd is a system and service manager commonly used for managing background daemon processes (also known as services) and other system resources. Systemd is the default…

Sub-technique of Create or Modify System Process (T1543).

Sigma detection rules (1)

T1543.002 Create or Modify System Process: Systemd Service

title: "T1543.002 Create or Modify System Process: Systemd Service"
id: afd96502-e0f9-42c1-8ae7-02a60b9c72ce
description: 'Detection of Systemd Service Creation or Modification on Linux. (Retargeted to the file_change auditd telemetry that actually captures this techniques behavior; see logsource below.) Tune using: ServicePathRegex, ExecStartPathAllowlist, UserContextFilter, FileEntropyThreshold, SystemctlOperationSet.'
references:
  - https://attack.mitre.org/techniques/T1543/002
author: Shahrukh Khan
date: 2026-06-09
license: MIT
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.t1543.002

logsource:
  category: file_change
  product: linux

detection:
  selection:
    type: PATH
    nametype: CREATE
    name|contains: '/etc/systemd/system/'
    name|endswith: '.service'
  selection_reload:
    type: EXECVE
    a0|endswith: '/systemctl'
    a1|contains: 'daemon-reload'

  condition: 1 of selection*

falsepositives:
  - Legitimate deployment of a new systemd service unit followed by the expected daemon-reload; scope ExecStartPathAllowlist to binaries outside standard system paths for stronger signal.

level: high

Related sub-techniques

Explore