Compliance Node Overview
MITRE ATT&CK T1543.002 (Systemd Service) is an Enterprise Persistence and Privilege Escalation sub-technique of T1543 (Create or Modify System Process). Adversaries may create or modify systemd services to repeatedly execute malicious payloads as part of persistence. Systemd is a system and service manager commonly used for managing background daemon processes (also known as services) and other system resources. Systemd is the default initialization (init) system on many Linux distributions replacing legacy init systems, including SysVinit and Upstart, while remaining backwards compatible. Affected platforms: Linux. MITRE-documented mitigations include M1018 User Account Management, M1022 Restrict File and Directory Permissions, M1026 Privileged Account Management, M1033 Limit Software Installation. The Center for Threat-Informed Defense maps this technique to NIST SP 800-53 Rev 5 controls AC-02, AC-03, AC-05, AC-06, AC-17, CA-07, CM-02, CM-03.
Pillar: Cybersecurity · Authority: MITRE Corporation · Version: 1.0.0 · Last updated:
Primary source: https://attack.mitre.org/techniques/T1543/002/
SHA-256 integrity: 92ca77d1c9c894aa50096438f8959a828b3831d8a183d6251cf60a74ca499fb1
Primary Citations — 7 traced to source
- MITRE ATT&CK Technique T1543.002: Systemd Service (https://attack.mitre.org/techniques/T1543/002/)
- MITRE ATT&CK Tactic TA0003: Persistence (https://attack.mitre.org/tactics/TA0003/)
+ 5 more citations (full bibliography, deterministic workflow, actionable schema and crosswalks) included in the vault unlock — $0.01 via Skyfire / L402 / Direct Base USDC.
Access