Linux auditd: Creation of systemd unit files in system/user directories

title: "Linux auditd: Creation of systemd unit files in system/user directories"
id: 5462dc06-fce7-4bba-bf90-10e67ce1c29e
status: test
description: This rule flags file creation events where a unit file path is created under systemd service directories on Linux. Attackers can abuse new or modified systemd unit files to execute malicious commands persistently with elevated privileges. The detection relies on auditd PATH create telemetry and checks the created file’s path and name patterns for system and user systemd unit locations.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1543.002/T1543.002.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/auditd/path/lnx_auditd_systemd_service_creation.yml
author: Pawel Mazur, Huntrule Team
date: 2022-02-03
modified: 2022-02-06
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.t1543.002
logsource:
  product: linux
  service: auditd
detection:
  path:
    type: PATH
    nametype: CREATE
  name_1:
    name|startswith:
      - /usr/lib/systemd/system/
      - /etc/systemd/system/
  name_2:
    name|contains: /.config/systemd/user/
  condition: path and 1 of name_*
falsepositives:
  - Admin work like legit service installs.
level: medium
license: DRL-1.1
related:
  - id: 1bac86ba-41aa-4f62-9d6b-405eac99b485
    type: derived