ATT&CK · T1569.003 · sub-technique
Systemctl
Tactics: execution
About
Adversaries may abuse systemctl to execute commands or programs. Systemctl is the primary interface for systemd, the Linux init system and service manager. Typically invoked from a shell, Systemctl can also be integrated into scripts or applications. Adversaries may use systemctl to execute commands or programs as Systemd Services. Common subcommands include: `systemctl start`, `systemctl stop`, `systemctl enable`, `systemctl disable`, and `systemctl status`.
Used by actors
1 known groups
Software
0 malware/tools implement this
None mapped.
Corpus indicators tagged with this technique
0 indicators in the corpus carry T1569.003.
No corpus indicators are tagged with this technique yet.