{"id":"T1543.002","name":"Systemd Service","url":"https://attack.mitre.org/techniques/T1543/002","tactics":["persistence","privilege-escalation"],"platforms":["Linux"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0253","stix_id":"x-mitre-detection-strategy--3c335443-c161-4149-9c85-d7a014550099","name":"Detection of Systemd Service Creation or Modification on Linux","url":"https://attack.mitre.org/detectionstrategies/DET0253","analytics":[{"id":"AN0701","stix_id":"x-mitre-analytic--4da5660a-3b1c-4b4d-ad79-991bef456b20","name":"Analytic 0701","description":"Detects the creation or modification of `.service` unit files in system/user-level directories, combined with execution of `systemctl`, `service`, or dynamically created drop-ins via systemd generators. Detects persistence by analyzing the `ExecStart` path, file entropy, and symlink usage, especially when paired with execution from `/tmp`, `/dev/shm`, or unmounted volumes.","url":"https://attack.mitre.org/detectionstrategies/DET0253#AN0701","platforms":["Linux"],"log_source_references":[{"name":"auditd:SYSCALL","channel":"write, open, or rename to /etc/systemd/system/*.service","data_component":"DC0039","data_component_name":"File Creation","log_source_slug":"auditd-syscall"},{"name":"auditd:SYSCALL","channel":"modification of existing .service file","data_component":"DC0061","data_component_name":"File Modification","log_source_slug":"auditd-syscall"},{"name":"auditd:SYSCALL","channel":"execution of systemctl or service with enable/start parameters","data_component":"DC0064","data_component_name":"Command Execution","log_source_slug":"auditd-syscall"},{"name":"auditd:SYSCALL","channel":"fork/exec of service via PID 1 (systemd)","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"auditd-syscall"},{"name":"linux:osquery","channel":"newly registered unit file with ExecStart pointing to unknown binary","data_component":"DC0060","data_component_name":"Service Creation","log_source_slug":"linux-osquery"}],"mutable_elements":[{"field":"ServicePathRegex","description":"Regex filters for systemd unit locations (e.g., `/etc/systemd/system/*.service`, `/lib/systemd/system/`)"},{"field":"ExecStartPathAllowlist","description":"Allowlist of trusted `ExecStart` binary paths (e.g., `/usr/bin/`, `/bin/`)"},{"field":"UserContextFilter","description":"List of usernames that are authorized to define user-level services"},{"field":"FileEntropyThreshold","description":"Entropy level of binaries referenced in `ExecStart` to detect packed or obfuscated payloads"},{"field":"SystemctlOperationSet","description":"Flags suspicious combinations such as `systemctl enable` + `systemctl start` within short interval"}],"live":true,"detection_strategies":["DET0253"],"techniques":["T1543.002"]}],"live":true,"version":"1.0","techniques":["T1543.002"]}],"sigma_rules":[{"id":"1bac86ba-41aa-4f62-9d6b-405eac99b485","title":"Systemd Service Creation","author":"Pawel Mazur","status":"test","level":"medium","date":"2022-02-03","modified":"2022-02-06","description":"Detects a creation of systemd services which could be used by adversaries to execute malicious code.","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1543.002/T1543.002.md"],"logsource":{"product":"linux","service":"auditd"},"tags":["attack.privilege-escalation","attack.persistence","attack.t1543.002"],"path":"rules/linux/auditd/path/lnx_auditd_systemd_service_creation.yml","techniques":["T1543.002"],"cves":[]},{"id":"2625cc59-0634-40d0-821e-cb67382a3dd7","title":"Service Reload or Start - Linux","author":"Jakob Weinzettl, oscd.community, CheraghiMilad","status":"test","level":"low","date":"2019-09-23","modified":"2025-03-03","description":"Detects the start, reload or restart of a service.","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1543.002/T1543.002.md"],"logsource":{"product":"linux","service":"auditd"},"tags":["attack.privilege-escalation","attack.persistence","attack.t1543.002"],"path":"rules/linux/auditd/execve/lnx_auditd_susp_service_reload_or_restart.yml","techniques":["T1543.002"],"cves":[]},{"id":"36603778-030c-43c4-8cbb-cd3c1d1a80c7","title":"LiteLLM / TeamPCP Supply Chain Attack Indicators","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"high","date":"2026-03-30","modified":null,"description":"Detects process executions related to the backdoored versions of LiteLLM (v1.82.7 or v1.82.8).\nIn March 2026, a supply chain attack was discovered involving the popular open-source LLM framework LiteLLM by Threat Actor TeamPCP.\nThe malicious package harvests every credential on the system, encrypts and exfiltrates them, and installs a persistent C2 backdoor.\n","references":["https://novasky.io/hunts/hunting-litellm-supply-chain","https://www.virustotal.com/gui/file/71e35aef03099cd1f2d6446734273025a163597de93912df321ef118bf135238/","https://huskyhacks.io/posts/litellm-cred-stealer/","https://www.wiz.io/blog/threes-a-crowd-teampcp-trojanizes-litellm-in-continuation-of-campaign"],"logsource":{"product":"linux","category":"process_creation"},"tags":["attack.initial-access","attack.t1195.002","attack.collection","attack.t1560.001","attack.persistence","attack.privilege-escalation","attack.t1543.002","detection.emerging-threats"],"path":"rules-emerging-threats/2026/TA/TeamPCP/proc_creation_lnx_teampcp_litellm_supply_chain_attack_indicators.yml","techniques":["T1195.002","T1560.001","T1543.002"],"cves":[]},{"id":"81c0b7f5-81c9-435e-a291-bc32fc2b72cd","title":"TeamPCP LiteLLM Supply Chain Attack Persistence Indicators","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"high","date":"2026-03-30","modified":null,"description":"Detects the creation of specific persistence files as observed in the LiteLLM PyPI supply chain attack.\nIn March 2026, a supply chain attack was discovered involving the popular open-source LLM framework LiteLLM by Threat Actor TeamPCP.\nThe malicious package harvests every credential on the system, encrypts and exfiltrates them, and installs a persistent C2 backdoor.\n","references":["https://novasky.io/hunts/hunting-litellm-supply-chain","https://www.virustotal.com/gui/file/71e35aef03099cd1f2d6446734273025a163597de93912df321ef118bf135238/","https://huskyhacks.io/posts/litellm-cred-stealer/","https://www.wiz.io/blog/threes-a-crowd-teampcp-trojanizes-litellm-in-continuation-of-campaign"],"logsource":{"product":"linux","category":"file_event"},"tags":["attack.persistence","attack.privilege-escalation","attack.t1543.002","attack.initial-access","attack.t1195.002","detection.emerging-threats"],"path":"rules-emerging-threats/2026/TA/TeamPCP/file_event_lnx_teampcp_litellm_supply_chain_attack_indicators.yml","techniques":["T1543.002","T1195.002"],"cves":[]}],"kev_cves":[],"_built":"2026-08-24 19:45 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}