MITRE ATT&CK - Técnica

T1543.002: Systemd Service

Systemd Service (T1543.002) é uma técnica catalogada no MITRE ATT&CK Enterprise usada como referência para mapear comportamento adversário em auditorias de segurança.

Técnica T1543.002 Enterprise ATT&CK

Contexto para AppSec

Em uma auditoria de AppSec, Systemd Service deve ser usada para revisar caminhos em que código, configuração, dependências ou infraestrutura podem viabilizar o comportamento descrito pela MITRE. No ATT&CK, ela aparece em Persistence e Privilege Escalation. As plataformas mapeadas pela MITRE incluem Linux. No Vigly, esse contexto ajuda a conectar evidências do repositório com priorização e remediação.

Tática/fase Persistence, Privilege Escalation
Plataformas MITRE Linux

Descrição oficial original do MITRE ATT&CK

Adversaries may create or modify systemd services to repeatedly execute malicious payloads as part of persistence. Systemd is a system and service manager commonly used for managing background daemon processes (also known as services) and other system resources. Systemd is the default initialization (init) system on many Linux distributions replacing legacy init systems, including SysVinit and Upstart, while remaining backwards compatible. Systemd utilizes unit configuration files with the .service file extension to encode information about a service's process. By default, system level unit files are stored in the /systemd/system directory of the root owned directories (/). User level unit files are stored in the /systemd/user directories of the user owned directories ($HOME). Inside the .service unit files, the following directives are used to execute commands: * ExecStart, ExecStartPre, and ExecStartPost directives execute when a service is started manually by systemctl or on system start if the service is set to automatically start.

  • ExecReload directive executes when a service restarts. * ExecStop, ExecStopPre, and ExecStopPost directives execute when a service is stopped. Adversaries have created new service files, altered the commands a .service file’s directive executes, and modified the user directive a .service file executes as, which could result in privilege escalation. Adversaries may also place symbolic links in these directories, enabling systemd to find these payloads regardless of where they reside on the filesystem. The .service file’s User directive can be used to run service as a specific user, which could result in privilege escalation based on specific user/group permissions. Systemd services can be created via systemd generators, which support the dynamic generation of unit files. Systemd generators are small executables that run during boot or configuration reloads to dynamically create or modify systemd unit files by converting non-native configurations into services, symlinks, or drop-ins (i.e., Boot or Logon Initialization Scripts).
Ver fonte oficial no MITRE ATT&CK

Como o Vigly audita a técnica Systemd Service automaticamente na sua pipeline

O Vigly cruza sinais de SAST, modelagem de ameaças, regras de negócio e evidências do repositório para priorizar riscos reais antes que eles cheguem à produção.

Conhecer a plataforma