systemd_timer_persistence.yml

# Rule version v1.0.1

dataTypes:
  - linux
name: Systemd Timer Persistence Mechanism
impact:
  confidentiality: 2
  integrity: 3
  availability: 2
category: Persistence
technique: "T1053.003 - Scheduled Task/Job: Cron"
adversary: origin
references:
  - https://attack.mitre.org/techniques/T1053/003/
  - https://www.freedesktop.org/software/systemd/man/systemd.timer.html
description: |
  Detects creation or modification of systemd timer units which can be used as a persistence mechanism. Systemd timers are an alternative to cron and can execute commands on a schedule.

  Next Steps:
  1. Review the timer unit file and associated service unit
  2. Check the OnCalendar or OnBoot directives for scheduling
  3. Examine the ExecStart command in the associated service
  4. Verify the timer was created by an authorized administrator
  5. Compare against baseline of known legitimate timers
  6. If unauthorized, disable the timer and investigate
where: |
  contains("origin.command", "systemctl") && contains("origin.command", ".timer") && regexMatch("origin.command", "(enable|reenable|start|link)")
deduplicateBy:
  - dataSource