Skip to content
Threat Feed
Subscribe
medium advisory

Linux Systemd Service Override Configuration Persistence

Systemd override configuration files can be leveraged by malicious actors to achieve persistence or escalate privileges by executing malicious commands during system startup or via systemd timers.

Triage facts

Revision 1
Evidence
Unknown
Severity
Medium
Sources
1 public source
Freshness
Revision 1Oct 21, 13:59 UTC
Source quality
A1Likely

Systemd override configuration files allow administrators to modify default service behavior. Attackers may create or rename these files in system or user service directories to inject directives such as ExecStart, ExecStartPre, ExecStartPost, Environment, or OnCalendar. This allows for the execution of unauthorized commands or payloads while leaving the original base unit file intact, facilitating persistent access and potential privilege escalation.

Detection and Investigation

The detection logic identifies the creation or renaming of .conf files within standard Systemd service override paths. Investigating alerts involves:

  • Comparing the new override file against the base unit file.
  • Inspecting directives like ExecStart, ExecStartPre, ExecStartPost, Environment, User, WorkingDirectory, OnCalendar, and WantedBy.
  • Tracing the originating process, parent process chain, and account context.
  • Checking for related systemctl operations, such as daemon-reload, enable, or restart.
  • Analyzing referenced scripts or binaries for suspicious content.

False Positives

Legitimate administrative maintenance may involve creating override files to adjust startup order, resource limits, or environment settings. Verification should include confirming the creating process and user session context align with authorized administrative activity.