Systemd Service Files

Location

Description

Systemd unit files defining services, their ExecStart commands, restart policies, dependencies, and user contexts. Custom units can be placed in /etc/systemd/system/ to override or extend defaults.

Forensic Value

Malicious systemd services provide robust persistence that survives reboots and automatic restarts on failure. The ExecStart directive reveals the exact binary and arguments executed. Services set to Restart=always will respawn even if killed. Checking for recently created .service files in /etc/systemd/system/ with unusual ExecStart paths (e.g., /tmp, /dev/shm, or hidden directories) identifies attacker persistence.

Tools Required

Collection Commands

tar czf /forensics/output/systemd_units.tar.gz /etc/systemd/system/ /usr/lib/systemd/system/

find /etc/systemd/system/ -name "*.service" -mtime -30 -exec ls -la {} \; > /forensics/output/recent_services.txt

grep -rn "ExecStart" /etc/systemd/system/*.service > /forensics/output/service_execstart.txt

find /home -path "*/.config/systemd/user/*.service" -exec cp --parents {} /forensics/output/ \;

Collection Constraints

• •Paths and log sources vary by distribution, init system, logging stack, and installed packages. Validate the active distro and service set before treating absence as meaningful.

MITRE ATT&CK Techniques

References