Systemd Timers

Adversaries may abuse systemd timers to perform task scheduling for initial or recurring execution of malicious code. Systemd timers are unit files with file extension <code>.timer</code> that control services. Timers can be set to run on a calendar event or after a time span relative to a starting point. They can be used as an alternative to Cron in Linux environments.¹ Systemd timers may be activated remotely via the <code>systemctl</code> command line utility, which operates over SSH.² Each <code>.timer</code> file must have a corresponding <code>.service</code> file with the same name, e.g., <code>example.timer</code> and <code>example.service</code>. <code>.service</code> files are Systemd Service unit files that are managed by the systemd system and service manager.³ Privileged timers are written to <code>/etc/systemd/system/</code> and <code>/usr/lib/systemd/system</code> while user level are written to <code>~/.config/systemd/user/</code>. An adversary may use systemd timers to execute malicious code at system startup or on a scheduled basis for persistence.⁴⁵⁶ Timers installed using privileged paths may be used to maintain root level persistence. Adversaries may also install user level timers to achieve user level persistence.⁷

1. archlinux Systemd Timers Aug 2020
2. Systemd Remote Control
3. Linux man-pages: systemd January 2014
4. Arch Linux Package Systemd Compromise BleepingComputer 10JUL2018
5. gist Arch package compromise 10JUL2018
6. acroread package compromised Arch Linux Mail 8JUL2018
7. Falcon Sandbox smp: 28553b3a9d

Groups using this technique

Claims

No public claim points at this technique yet.

Auto-ingested and not human-reviewed; confidence and validity read by citation.