Scheduled Task/Job: Systemd Timers T1053.006
Tactics: Execution, Persistence, Privilege Escalation
Adversaries may abuse systemd timers to perform task scheduling for initial or recurring execution of malicious code. Systemd timers are unit files with file extension .timer that control services. Timers can be set to run on a calendar event or after a time span relative to a starting point. They can be used as an alternative to Cron in Linux environments. Systemd timers may be activated remotely via the systemctl command line utility, which operates over SSH.
Events covered
3 catalog events are tagged with this technique by at least one rule.
| Provider | Event | Title |
|---|---|---|
| Linux-Auditd | Event ID 1327 | PROCTITLE |
| Sysmon-for-Linux | Event ID 1 | Process Create |
| Sysmon-for-Linux | Event ID 11 | File created |
Authoring guide
These 6 rules share fields, values, and exclusions.
Fields filtered most (12 distinct)
These fields appear most often in rule filters.
Top indicator values (80 distinct)
These values appear most often in rule predicates.
Exclusions (103 distinct)
These values appear most often in top-level exclusions.
Rules under this technique
These vendors publish rules tagged with this technique.