T1569.003 Systemctl
sub-techniqueEnterpriseAdversaries may abuse systemctl to execute commands or programs. Systemctl is the primary interface for systemd, the Linux init system and service manager. Typically invoked from a shell, Systemctl can also be integrated into scripts or applications. Adversaries may use systemctl to execute commands or programs as Systemd Services. Common subcommands include: `systemctl start`, `systemctl stop`, `systemctl enable`, `systemctl disable`, and `systemctl status`.
01
platforms
Platforms this applies to.
Linux
02
tactics
ATT&CK tactics this technique serves.
03
sub-technique of
The broader entity this sits under.
04
mitigations
ATT&CK mitigations that reduce this.
05
detected by (4)
Data components that detect this.
06
groups (1)
Threat groups associated with this.
07
software (1)
Malware and tools associated with this.
08
source
Where this definition is published.