Systemd unit file written under a unit search path on Linux

1title: Systemd unit file written under a unit search path on Linux2id: 5718f03f-ebf8-4248-b7e4-576e615a36b83status: experimental4description: |5  Matches the file-creation and file-modification legs of AN0701: an auditd PATH6  record naming a file inside one of the directories systemd loads unit7  definitions from, which is where this technique plants the `ExecStart` line it8  wants re-executed at every boot. The directory list is MITRE's9  `ServicePathRegex` knob, populated here with the system and user unit search10  paths from systemd.unit(5); `/lib/systemd/system/` is written without the11  `/usr` prefix on purpose, because `contains` matching means that one entry also12  covers `/usr/lib/systemd/system/` and `/usr/local/lib/systemd/system/` on the13  merged-/usr layouts every current distribution uses. The selections are14  anchored on the directory rather than on a `.service` suffix because the two15  most common ways to change what a service runs do not produce a `.service`16  filename at all — `systemctl edit` writes `<unit>.service.d/override.conf`,17  and `systemctl enable` creates a symlink inside `<target>.target.wants/` — so18  a suffix gate would miss both. The cost is a deliberate over-match: a `.timer`19  or `.socket` unit written into the same directories also fires here, and those20  belong to T1053.006 rather than to this technique. A separate suffix selection21  and a watch-key selection are present because auditd records `name=` exactly22  as it was handed to the syscall, so an edit made from inside the directory23  logs a bare `foo.service` with the directory only on a CWD record Sigma cannot24  join; the key branch closes the same gap for any filename, but only for25  deployments whose watches carry a key containing `systemd`. Three parts of the26  analytic are out of reach. PATH records carry a filename and never file27  contents, so the `ExecStart` target cannot be read at all and MITRE's28  `ExecStartPathAllowlist` and `FileEntropyThreshold` knobs — along with the29  analytic's `/tmp` and `/dev/shm` payload check — have nothing to act on here;30  auditd splits PATH and SYSCALL into separate records for one event and the31  writing process's `uid` and `auid` live only on the SYSCALL side, so32  `UserContextFilter` cannot be applied inside these selections; and the33  `systemctl enable` plus `systemctl start` pairing behind `SystemctlOperationSet`34  is a separate execve event with no join available in lib/sigma, which is also35  why it is not OR-ed in — every service start on every host would match. The36  linux/osquery source in the brief is not attempted, because it has no37  standardised Sigma field names. Prerequisite: no distribution audits any of38  these paths by default, and an auditd watch covers one concrete directory39  only, so each selection is blind until its own watch is loaded —40  `-w /etc/systemd/system -p wa -k systemd`,41  `-w /usr/lib/systemd/system -p wa -k systemd`,42  `-w /run/systemd/system -p wa -k systemd` and the three matching43  `.../systemd/user` paths. The two home-relative entries are weaker still:44  `~/.config/systemd/user/` and `~/.local/share/systemd/user/` cannot be45  watched generically, so they stay dead until a per-user watch is added or46  `-w /home -p wa -k systemd` is accepted along with the volume that brings —47  and user-level units are a documented variant of this technique, so treat48  that as missing coverage rather than as absence of the behaviour. Zero rows49  from any of these branches reads as quiet when it actually means blind. Note50  also that one write can match twice, once on the PATH record and once on the51  SYSCALL record carrying the key, so hits should be deduplicated on the audit52  event id before volume is judged.53  UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0253, not hand-written and not tested by its author. Any lab result is on this rule's own page.54references:55  - https://attack.mitre.org/techniques/T1543/00256  - https://attack.mitre.org/detectionstrategies/DET025357author: Siemphony pipeline (machine-derived from MITRE ATT&CK v19.2)58date: 2026-08-1659tags:60  - attack.persistence61  - attack.privilege-escalation62  - attack.t1543.00263logsource:64  product: linux65  service: auditd66detection:67  selection_system_units:68    type: 'PATH'69    name|contains:70      - '/etc/systemd/system/'71      - '/run/systemd/system/'72      - '/lib/systemd/system/'73  selection_user_units:74    type: 'PATH'75    name|contains:76      - '/etc/systemd/user/'77      - '/run/systemd/user/'78      - '/lib/systemd/user/'79      - '/.config/systemd/user/'80      - '/.local/share/systemd/user/'81  selection_unit_suffix:82    type: 'PATH'83    name|endswith: '.service'84  selection_watch_key:85    key|contains: 'systemd'86  condition: 1 of selection*87falsepositives:88  - "Package installation, upgrade and removal. Every apt, dnf or zypper transaction that touches a daemon writes its unit file into /usr/lib/systemd/system, and the post-install script then runs systemctl enable, which creates a symlink under /etc/systemd/system/multi-user.target.wants. On a patched estate this is the highest-volume match by a wide margin and is the reason the level is low rather than medium."89  - "Configuration management convergence. The Ansible systemd, template and copy modules, Puppet service and file resources, Chef and Salt all rewrite unit files and re-run daemon-reload on every run, which on a half-hourly schedule means several matching PATH records per managed host per run whether or not the content changed."90  - "Ordinary service administration. Any systemctl enable or systemctl disable creates or removes a symlink inside a .wants directory under /etc/systemd/system, and systemctl edit writes an override.conf drop-in through a temporary file and a rename, so one intentional change by an administrator emits several PATH records."91  - "Host provisioning. cloud-init, container and VM image bakes, Kubernetes node bootstrap writing kubelet drop-ins, and Docker or containerd installers all lay down unit files while the machine is being created, producing a burst of matches on every new host."92  - "Agent and appliance installers. Backup, monitoring, vulnerability-scanning and antivirus packages install their own unit at setup and rewrite it at every version upgrade, under root, from a legitimate package manager."93level: low