T1569.003 — Systemctl

Tactic: Execution · Platforms: Linux

Adversaries may abuse systemctl to execute commands or programs. Systemctl is the primary interface for systemd, the Linux init system and service manager. Typically invoked from a shell, Systemctl can also be integrated into scripts or applications. Adversaries may use systemctl to execute…

Sub-technique of System Services (T1569).

Sigma detection rules (1)

T1569.003 System Services: Systemctl

title: "T1569.003 System Services: Systemctl"
id: cffd002a-5d96-412c-b98f-fc351c9bafa8
description: 'Detection Strategy for System Services: Systemctl, covering both direct unit start (systemctl start <unit>) and enable+start-now (systemctl enable --now <unit>) invocations used to execute a service immediately. (Retargeted to the process_creation auditd telemetry that actually captures this techniques behavior; see logsource below.) Tune using: MonitoredPaths, SuspiciousSubcommands, CorrelationWindow.'
references:
  - https://attack.mitre.org/techniques/T1569/003
author: Shahrukh Khan
date: 2026-06-07
license: MIT
tags:
  - attack.execution
  - attack.t1569.003

logsource:
  category: process_creation
  product: linux

detection:
  selection_enable_now:
    type: EXECVE
    a0|endswith: '/systemctl'
    a1|contains|all:
      - 'enable'
      - '--now'
  selection_start:
    type: EXECVE
    a0|endswith: '/systemctl'
    a1: 'start'

  condition: 1 of selection_*

falsepositives:
  - Legitimate deployment automation and routine service management (starting an application unit, or enabling and starting it in one step) invoke both patterns; scope MonitoredPaths to unit files outside configuration-management-owned directories, and expect systemctl start against well-known system units (sshd, cron, docker, nginx) to be routine and high-volume.

level: medium

Related sub-techniques

Explore