System Services: Systemctl (T1569.003)

Tactic: Execution · Platforms: Linux

The interactive view maps 1 detection strategy, 1 mitigation, 1 threat group to this technique, alongside D3FEND countermeasures and data-component coverage.

Sub-technique of System Services (T1569).

Overview

Adversaries may abuse systemctl to execute commands or programs. Systemctl is the primary interface for systemd, the Linux init system and service manager. Typically invoked from a shell, Systemctl can also be integrated into scripts or applications.

Adversaries may use systemctl to execute commands or programs as Systemd Services. Common subcommands include: `systemctl start`, `systemctl stop`, `systemctl enable`, `systemctl disable`, and `systemctl status`.

Explore

• Open T1569.003 in the interactive ATT&CK matrix
• ATT&CK Intelligence View guide
• Official MITRE ATT&CK entry for T1569.003
• Sigma detection rules for MITRE ATT&CK
• Built by Shahrukh Khan