Systemd Service Creation

Title: Systemd Service Creation
Status: test
Description:Detects a creation of systemd services which could be used by adversaries to execute malicious code.
References:
  -https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1543.002/T1543.002.md
Author: Pawel Mazur
Date: 2022-02-03
modified:2022-02-06
Tags:

• -'attack.privilege-escalation'
• -'attack.persistence'
• -'attack.t1543.002'

Logsource:

• product: linux
• service: auditd

Detection:
  path:
    type: 'PATH'
    nametype: 'CREATE'
  name_1:
    name|startswith:
      -'/usr/lib/systemd/system/'
      -'/etc/systemd/system/'

  name_2:
    name|contains: '/.config/systemd/user/'
  condition:path and 1 of name_*
Falsepositives:
  -Admin work like legit service installs.
Level: medium