T1543.002 Systemd Service — Attack Simulation

Adversaries may create or modify systemd services to repeatedly execute malicious payloads as part of persistence. Systemd is a system and service manager commonly used for managing background daemon processes (also known as services) and other system resources. Systemd is the default initialization (init) system on many Linux distributions replacing legacy init systems, including SysVinit and Upstart, while remaining backwards compatible.…

Technique description

At least one platform-compatible Atomic procedure is documented. Individual review, lab prerequisites, and validation remain required.

Official ATT&CK definition · Detection rules and anomaly models

Documented simulation candidates

Create SysV Service
linux automated sh
Procedure 760fe8d2-79d9-494f-905e-a239a3df86f6; elevation required; cleanup present, not reviewed. Not executed or individually validated.
TeamPCP Aqua Trivy Persistence
linux automated bash
Procedure a29738b0-0e14-488c-984f-6a851fcdbcfe; elevation not declared required; cleanup present, not reviewed. Not executed or individually validated.
Create Systemd Service file, Enable the service , Modify and Reload the service.
linux automated bash
Procedure c35ac4a8-19de-43af-b9f8-755da7e89c89; elevation required; cleanup present, not reviewed. Not executed or individually validated.
Create Systemd Service
linux automated bash
Procedure d9e4f24f-aa67-4c6e-bcbf-85622b697a7c; elevation required; cleanup present, not reviewed. Not executed or individually validated.

Connected ecosystem references

Linked tags

enterprise cloud-hosted-endpoint onprem Linux persistence privilege-escalation isolated_authorized_lab procedure_review_required telemetry_configuration_required some_candidates_require_elevation

can_simulate subtechnique source_mapped

Detection and collection

T1543.002 detection workspace

Attack tools

Pupy · S0192

Threat actor context

These are explicit actor-to-technique associations in the existing Threat Matrix snapshot, not attribution of an event or proof that a detector identifies the actor. No tool-to-actor relationship is inferred.

Existing research

Threat Matrix: knowledge routes, evidence and actor context

Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.