Last updated
Was this helpful?
Last updated
Was this helpful?
Name: Systemd Timers
ID: T1053.006
Tactics: , ,
Technique:
Systemd Timers (T1053.006) is a sub-technique under the Scheduled Task/Job technique (T1053) within the MITRE ATT&CK framework. It involves adversaries leveraging systemd timer units, a Linux-based scheduling mechanism, to execute malicious scripts or binaries at predetermined intervals or specific times. Systemd timers are similar in functionality to cron jobs but offer enhanced flexibility, reliability, and logging capabilities, making them an attractive option for attackers seeking persistence, execution, or privilege escalation on compromised Linux systems.
Systemd timers are used to schedule tasks using two primary components: timer units (.timer) and service units (.service). Attackers typically use these components in combination to achieve persistent execution of malicious payloads.
Timer unit files (.timer) define the schedule or event that triggers execution. These files specify time-based triggers (e.g., daily, weekly, monthly) or events (e.g., boot completion, idle state).
Service unit files (.service) define the actual command, script, or binary to execute when triggered by the timer unit.
/etc/systemd/system/: Global systemd configuration directory, requiring root privileges.
~/.config/systemd/user/: User-specific timers and services, not requiring root privileges.
Creating malicious timer and service unit files:
Enabling and starting timer units:
Checking timer status:
Persistent execution: Timers can ensure the malicious payload executes regularly, surviving reboots and system updates.
Stealth: Timers can be named deceptively similar to legitimate systemd timers, complicating detection.
Logging: Systemd timers provide integrated logging, which attackers may manipulate or clear to obscure their activities.
Attackers typically utilize Systemd Timers at various stages of the cyber kill chain, primarily to establish persistence and maintain long-term access to compromised systems. Common scenarios and stages include:
Persistence: Attackers frequently leverage systemd timers to maintain a foothold, ensuring their payload executes at regular intervals or at boot time.
Execution: Timers provide attackers with scheduled execution capabilities, allowing periodic data exfiltration, command-and-control beaconing, or lateral movement within the compromised environment.
Privilege Escalation: If attackers have access to privileged accounts, they may create or modify system-wide timer units to execute malicious commands with elevated privileges.
Defense Evasion: Systemd timers can be named similarly to legitimate services, enabling attackers to blend in with normal system operations and evade detection.
Detection of malicious Systemd Timers involves monitoring, analyzing, and auditing specific system activities, files, and behaviors. Common detection methods include:
File Integrity Monitoring (FIM): Detecting unauthorized creation or modification of .timer and .service files, especially in system-wide directories (/etc/systemd/system/) or unexpected user directories (~/.config/systemd/user/).
Systemd Logs and Auditing: Reviewing systemd logs (journalctl) for suspicious timer execution, unexpected job failures, or unusual scheduling patterns.
Real-time Monitoring Tools: Deploying endpoint detection and response (EDR) solutions, Security Information and Event Management (SIEM) systems, or Linux auditing tools (auditd) to monitor and alert on suspicious timer creation and execution.
Command Execution Monitoring: Auditing commands such as systemctl enable, systemctl start, or systemctl list-timers executed by unauthorized or unexpected users.
Behavioral Analysis: Identifying abnormal timer schedules (e.g., timers triggering execution at unusual intervals or times) or unusual system load patterns.
Unexpected .timer and .service files in system or user directories.
Suspicious timer names mimicking legitimate systemd timers.
Unusual periodic network connections or data transfers correlating with timer execution intervals.
Unexplained cron-like behavior without corresponding cron jobs.
Early detection of malicious Systemd Timers is critical due to their potential impacts on system security, stability, and confidentiality. Key reasons include:
Persistence and Long-term Access: Undetected timers allow attackers prolonged access to compromised systems, facilitating further malicious activities such as lateral movement, data exfiltration, or privilege escalation.
Data Exfiltration and Espionage: Timers can be employed to periodically exfiltrate sensitive data or intellectual property, potentially causing significant financial and reputational damage.
Resource Abuse: Attackers can leverage scheduled tasks to abuse system resources (e.g., cryptomining, denial-of-service attacks), negatively impacting system performance and availability.
Stealth and Evasion: Attackers may disguise timers as legitimate system tasks, complicating detection and forensic analysis. Early detection helps security teams mitigate these risks and prevent further compromise.
Real-world examples of attackers utilizing Systemd Timers include:
Rocke Group Cryptomining Campaign:
Scenario: The Rocke threat group deployed cryptomining malware on compromised Linux servers using systemd timers to maintain persistence and ensure continuous mining operations.
Tools Used:
Malicious .timer and .service unit files for scheduled execution.
Monero cryptocurrency mining binaries.
Impact: Resource exhaustion, increased energy costs, reduced system performance, and potential damage to hardware.
Skidmap Linux Malware:
Scenario: Skidmap malware leveraged systemd timers to periodically execute malicious kernel modules and rootkits, maintaining stealthy persistence and evading traditional detection mechanisms.
Tools Used:
Malicious systemd timer units combined with rootkits and kernel-level backdoors.
Impact: Persistent root-level access, data theft, compromised system integrity, and significant detection difficulties.
TeamTNT Malware Campaign:
Scenario: TeamTNT malware operators utilized systemd timers to periodically execute scripts that scanned cloud environments for exposed Docker APIs and Kubernetes clusters, enabling lateral movement and further compromise.
Tools Used:
Bash scripts scheduled via systemd timers.
Network scanning utilities.
Impact: Unauthorized access to cloud infrastructure, lateral movement, potential data breaches, and unauthorized cryptomining activities.
Systemd Timers [T1053.006]