FORENSIA

ATT&CK · T1569.003 · sub-technique

Systemctl

Tactics: execution

About

Adversaries may abuse systemctl to execute commands or programs. Systemctl is the primary interface for systemd, the Linux init system and service manager. Typically invoked from a shell, Systemctl can also be integrated into scripts or applications. Adversaries may use systemctl to execute commands or programs as Systemd Services. Common subcommands include: `systemctl start`, `systemctl stop`, `systemctl enable`, `systemctl disable`, and `systemctl status`.

Used by actors

1 known groups

Software

0 malware/tools implement this

None mapped.

Corpus indicators tagged with this technique

0 indicators in the corpus carry T1569.003.

No corpus indicators are tagged with this technique yet.