AN0701
Analytic 0701
Linux
Detects the creation or modification of `.service` unit files in system/user-level directories, combined with execution of `systemctl`, `service`, or dynamically created drop-ins via systemd generators. Detects persistence by analyzing the `ExecStart` path, file entropy, and symlink usage, especially when paired with execution from `/tmp`, `/dev/shm`, or unmounted volumes.
auditd:SYSCALL
write, open, or rename to /etc/systemd/system/*.service
auditd:SYSCALL
modification of existing .service file
auditd:SYSCALL
execution of systemctl or service with enable/start parameters
auditd:SYSCALL
fork/exec of service via PID 1 (systemd)
linux:osquery
newly registered unit file with ExecStart pointing to unknown binary
[ServicePathRegex]
Regex filters for systemd unit locations (e.g., `/etc/systemd/system/*.service`, `/lib/systemd/system/`)
[ExecStartPathAllowlist]
Allowlist of trusted `ExecStart` binary paths (e.g., `/usr/bin/`, `/bin/`)
[UserContextFilter]
List of usernames that are authorized to define user-level services
[FileEntropyThreshold]
Entropy level of binaries referenced in `ExecStart` to detect packed or obfuscated payloads
[SystemctlOperationSet]
Flags suspicious combinations such as `systemctl enable` + `systemctl start` within short interval