Suspicious systemd timer activity

Synopsis

Field	Value
Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	1 Day
Required Data	XDR Agent
ATT&CK Tactic	Execution (TA0002), Persistence (TA0003), Privilege Escalation (TA0004)
ATT&CK Technique	Scheduled Task/Job: Systemd Timers (T1053.006)
Severity	Low

Description

Suspicious systemd timer activity, which may indicate an attempt to establish persistence.

Attacker's Goals

An adversary may use systemd timers to execute malicious code at system startup or on a scheduled basis for persistence.

Investigative actions

Check the systemd timer file change and try to understand the impact of the systemd timers change.