title: Systemd Service Created in User-Writable or Temp Path

id: d4a5c6f7-0f65-4c8c-a1a7-d4428e73bb05

status: experimental

description: >

  Detects creation of a systemd unit file outside the standard package-managed locations

  or pointing ExecStart at a temp/home path - a common Linux persistence technique.

references:

  - https://attack.mitre.org/techniques/T1543/002/

author: Zion Boggan

date: 2026-05-16

tags:

  - attack.persistence

  - attack.t1543.002

logsource:

  product: linux

  category: file_event

detection:

  selection_unit:

    TargetFilename|endswith: '.service'

    TargetFilename|contains:

      - '/etc/systemd/system/'

      - '/.config/systemd/user/'

      - '/run/systemd/system/'

  filter_pkg:

    Image|endswith:

      - '/dpkg'

      - '/rpm'

      - '/apt'

      - '/yum'

      - '/dnf'

      - '/systemctl'

  condition: selection_unit and not filter_pkg

falsepositives:

  - Admins hand-installing units; baseline known unit deployments.

level: medium