T1543.002PersistenceAdvancedDefense plan →

Linux Attack Detection and DFIR: Persistence, Privilege Escalation, and Log Analysis

HARDEC · Savunma Güvenliği Ekibi·Published: June 13, 2026·Updated: July 15, 2026·19 min read

For SOC and IR teams operating in Linux environments: persistence mechanisms (cron/systemd/shell startup files/SSH authorized_keys/LD_PRELOAD/kernel module), privilege escalation paths (SUID/SGID, sudo misconfiguration, capabilities), and the forensic analysis methodology that surfaces them — auditd ruleset, auth.log/journald queries, /proc live response, and hardening controls.

Exploit

Prevention

Detection

Defense profile:2 detection rules 11 mitigations 1 baseline controls 2 response playbooks

Swipe or use the arrows to move between sections

Section 1 / 3

Zafiyet (Vulnerability)

Tehdit bağlamı, zafiyet ve istismar senaryosu

Beta

This section is not open yet

Titles and summaries are free. The detail of this section is not published yet. You can request the offline comparison tool for the open environments with a company email.

Request the offline tool →

Section 2 / 3

Prevention & Hardening

Savunma teknolojileri, policy ve sertleştirme

Beta

This section is not open yet

Titles and summaries are free. The detail of this section is not published yet. You can request the offline comparison tool for the open environments with a company email.

Request the offline tool →

Section 3 / 3

Detection

Davranış, loglama ve detection kuralları

Beta

This section is not open yet

Titles and summaries are free. The detail of this section is not published yet. You can request the offline comparison tool for the open environments with a company email.

Request the offline tool →

Information note

Detection insight: On Linux systems, correct configuration of the auditd rule set is critical for detecting persistence and privilege escalation. File-watch rules should be added for changes under /etc/sudoers and the /etc/sudoers.d/ directory; failed sudo attempts in auth.log / secure files and short-interval root account sessions should be defined as priority alert conditions. A common mistake is adding auditd rules only to the startup file without reloading the running service.

Detection rules

Directly copyable rules (Sigma/KQL/…) that detect this technique. Each rule specifies its required telemetry, maturity, and source.

Linux Systemd Suspicious Service Activation - systemctl enable

Detects the use of the systemctl enable command on Linux with suspicious service units containing /tmp, /dev/shm, or script interpreter references. Indicates the persistence installation phase.

high

sigmaExperimental

Show ruleHide rule

title: Şüpheli Systemd Servis Etkinleştirme (systemctl enable) - Linux
id: 0b4f8e2a-6c3d-4b9f-d5a8-9e1c7b4f0d25
status: experimental
description: |
  Linux process creation logları üzerinden beklenmedik konumlardan veya
  şüpheli ExecStart yollarıyla systemctl enable komutunun yürütülmesini tespit eder.
  Saldırganlar kötü amaçlı servisi etkinleştirerek yeniden başlatmada otomatik
  çalışmasını sağlar. /tmp, /dev/shm veya home dizinlerinden çalışan
  servis birimleri özellikle şüphelidir.
references:
  - https://attack.mitre.org/techniques/T1543/002/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_systemctl_new_service.yml
  - https://www.elastic.co/security-labs/primer-on-persistence-mechanisms
author: CyberSecLab (AI)
date: 2026-06-13
modified: 2026-06-13
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.t1543
  - attack.t1543.002
logsource:
  category: process_creation
  product: linux
detection:
  selection_systemctl:
    Image|endswith:
      - '/systemctl'
      - '/bin/systemctl'
      - '/usr/bin/systemctl'
  selection_enable_cmd:
    CommandLine|contains:
      - 'enable'
      - 'daemon-reload'
      - 'start'
  selection_suspicious_service:
    CommandLine|contains:
      - '/tmp/'
      - '/dev/shm/'
      - '/var/tmp/'
      - '.sh '
      - 'bash '
      - 'python'
      - 'perl '
      - 'nc '
      - 'ncat'
  filter_known_services:
    CommandLine|contains:
      - 'NetworkManager'
      - 'ssh.service'
      - 'sshd.service'
      - 'cron.service'
      - 'docker.service'
      - 'nginx.service'
      - 'apache2.service'
      - 'httpd.service'
      - 'mysql.service'
      - 'postgresql.service'
  condition: all of selection_* and not filter_known_services
falsepositives:
  - Sistem yöneticileri yeni kurulu servisleri etkinleştirebilir
  - Uygulama kurulum scriptleri servis etkinleştirme yapabilir
  - Docker container başlangıç scriptleri benzer komutlar çalıştırabilir
level: high

Not validated

Telemetry required to run: Linux Process Creation (auditd execve syscall, Sysmon for Linux)process_creation / linuxLinux

False positive: Application installation scripts and administrators may enable new services; known legitimate service names should be filtered.

Source: SIGMA · CC BY-SA 4.0 — AI üretimi, doğrulanmamış

Mitigations

Prevention and hardening measures that mitigate or block this technique.

Audit

Prevention

Advanced audit policy + command-line auditing + Sysmon + directory access auditing: the telemetry that detection requires.

Information note

Informational note: Default Windows audit policies are insufficient; critical events such as failed logons, sensitive privilege use, and object access require additional configuration. Process creation command-line records and network connection logs must be collected with Sysmon. On Linux, auditd default settings are extremely minimal and must be customized for security use cases. Since collection is impossible without log generation, audit policy configuration must be completed before SIEM integration.

Behavior Prevention on Endpoint

Prevention

Block common attack behaviors using Defender ASR rules and Office macro restrictions.

Information note

Informational note: Behavioral prevention at the endpoint encompasses EDR and XDR capabilities beyond signature-based AV. Microsoft Defender ASR rules stop Office applications from spawning child processes, executable content from email, and PowerShell injection. ASR rules should first be deployed in audit mode to assess the false positive rate before switching to block mode.

Baseline controls against this technique

The following security baseline controls mitigate this technique. Compare your organization's configuration against the relevant baseline by .

Response playbooks

NIST/SANS phase-based response workflows to follow when this technique is detected.

Techniques in the Persistence tactic

T1053.005PersistenceAdvanced

Windows Task Scheduler (schtasks.exe / Schedule.Service COM) is widely used by attackers for both persistence and remote execution (lateral movement). This article covers schtasks syntax, XML task structure, TaskCache registry, EID 4698/4699/4700/4701/4702 + TaskScheduler/Operational 106/140/141/200/201 telemetry, Sigma rules, and hardening controls.

June 13, 202610 min read

Exploit

Prevention

Detection

References

MITRE ATT&CK — T1543.002: Linux Attack Detection and DFIR: Persistence, Privilege Escalation, and Log Analysis ↗

This article is based on the MITRE ATT&CK framework; the detection, defense, and response content was prepared independently.

title: Linux Systemd Servis Kalıcılığı - Şüpheli .service Dosyası Oluşturma (auditd) id: 7f3c9b1e-4a5d-4f2c-c8b7-6e9d0a3f5c28 status: experimental description: | Linux auditd logları üzerinden systemd servis dizinlerinde yeni .service dosyası oluşturulmasını veya mevcut dosyaların değiştirilmesini tespit eder. Saldırganlar kalıcılık sağlamak için /etc/systemd/system/ veya /usr/lib/systemd/system/ dizinlerine kötü amaçlı servis birimi ekler. Bu teknik root erişimi gerektirir ve sistemin yeniden başlatılmasında veya 'systemctl enable' çalıştırılmasında aktif olur. references: - https://attack.mitre.org/techniques/T1543/002/ - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/auditd/lnx_auditd_systemd_service_creation.yml - https://www.freedesktop.org/software/systemd/man/systemd.service.html - https://www.mandiant.com/resources/blog/attackers-use-systemd-for-persistence author: CyberSecLab (AI) date: 2026-06-13 modified: 2026-06-13 tags: - attack.persistence - attack.privilege-escalation - attack.t1543 - attack.t1543.002 logsource: product: linux service: auditd detection: selection_syscall: type: - 'CREATE' - 'WRITE' - 'OPEN' selection_systemd_paths: name|startswith: - '/etc/systemd/system/' - '/usr/lib/systemd/system/' - '/usr/local/lib/systemd/system/' - '/run/systemd/system/' selection_service_ext: name|endswith: - '.service' - '.timer' - '.socket' - '.path' filter_package_mgr: exe|contains: - 'apt' - 'dpkg' - 'rpm' - 'yum' - 'dnf' - 'zypper' - 'pacman' filter_trusted_paths: exe|startswith: - '/usr/bin/ansible' - '/usr/bin/chef' - '/opt/puppet' - '/usr/bin/salt' condition: all of selection_* and not 1 of filter_* falsepositives: - Sistem yöneticileri manuel olarak servis dosyaları oluşturabilir - Yazılım kurulum scriptleri systemd servis dosyaları ekleyebilir - Paket yöneticileri (apt, yum, dnf) servis dosyaları kurabilir - filtreden geçirilmiştir - Ansible, Puppet, Chef gibi konfigürasyon yönetimi araçları level: medium

Linux Attack Detection and DFIR: Persistence, Privilege Escalation, and Log Analysis

Zafiyet (Vulnerability)

This section is not open yet

Prevention & Hardening

This section is not open yet

Detection

This section is not open yet

Detection rules

Linux Systemd Suspicious Service Activation - systemctl enable

Mitigations

Audit

Behavior Prevention on Endpoint

Baseline controls against this technique

Response playbooks

Techniques in the Persistence tactic

References

Linux Systemd Service Persistence - New/Modified .service File

Code Signing

Limit Software Installation

Linux Kernel Hardening

Operating System Configuration

Privileged Account Management

Restrict File and Directory Permissions

Software Configuration

SSH Hardening

User Account Management

WMI Event Subscription Persistence: Hidden Backdoors with EventFilter / EventConsumer / __FilterToConsumerBinding

Windows Service and SCM Abuse: Persistence, Privilege Escalation, and Lateral Movement

Linux Root-Level Compromise — Disk Imaging and Deep Forensic Analysis

Linux Persistence Detection and DFIR — Alert Triage and Remote Investigation

Linux Attack Detection and DFIR: Persistence, Privilege Escalation, and Log Analysis

This section is not open yet

This section is not open yet

This section is not open yet

Detection rules

Linux Systemd Suspicious Service Activation - systemctl enable

Mitigations

Audit

Behavior Prevention on Endpoint

Baseline controls against this technique

Response playbooks

Techniques in the Persistence tactic

References

Linux Systemd Service Persistence - New/Modified .service File

Code Signing

Limit Software Installation

Linux Kernel Hardening

Operating System Configuration

Privileged Account Management

Restrict File and Directory Permissions

Software Configuration

SSH Hardening

User Account Management

WMI Event Subscription Persistence: Hidden Backdoors with __EventFilter / __EventConsumer / __FilterToConsumerBinding

Windows Service and SCM Abuse: Persistence, Privilege Escalation, and Lateral Movement

Linux Root-Level Compromise — Disk Imaging and Deep Forensic Analysis

Linux Persistence Detection and DFIR — Alert Triage and Remote Investigation

WMI Event Subscription Persistence: Hidden Backdoors with EventFilter / EventConsumer / __FilterToConsumerBinding