Live Active security incident? Get immediate response
MITRE ATT&CK® Technique

T1569.003: Systemctl

Adversaries may abuse systemctl to execute commands or programs. Systemctl is the primary interface for systemd, the Linux init system and service manager. Typically invoked from a shell, Systemctl can also be integrated into scripts or applications.

Adversaries may use systemctl to execute commands or programs as Systemd Services. Common subcommands include: `systemctl start`, `systemctl stop`, `systemctl enable`, `systemctl disable`, and `systemctl status`.[1]

EnterpriseT1569.003Sub-techniqueObject v1.0 Modified
Discuss defensive coverage Back to ATT&CK
Glexia's Take

Analyst context for executives and security teams

Analyst confidence Medium

Systemctl matters because it is a normal Linux administration interface that can also be abused to run programs through system services. For leaders, the risk is not the tool itself but whether the organization can distinguish approved service administration from suspicious execution on Linux systems, especially where uptime, cloud workloads, or container-supporting hosts depend on systemd-managed services.

Executive priority

Prioritize this as a Linux execution visibility and privilege-governance issue. Security leaders should ask whether SOC and IR teams can see systemctl use, service starts/stops/enables/disables, and related account context on critical Linux assets. Because the supplied ATT&CK relationship maps mitigation to User Account Management, executive focus should include least privilege, account lifecycle controls, and evidence that service-management privileges are limited and auditable.

Technical view

This is an execution sub-technique under System Services for Linux. Defenders should validate coverage for systemctl invocations and systemd service activity, including common administrative subcommands such as start, stop, enable, disable, and status. ATT&CK provides no official detection text for this object, but a related detection strategy, DET0073, is linked. Detection engineering should therefore be based on local baselines: which users, scripts, automation tools, and maintenance windows normally manage services, and which service changes or executions are unusual for the host role.

Likely telemetry

  • Linux process execution telemetry showing systemctl command lines and parent processes
  • Authentication, sudo, and privilege-escalation logs tied to the user or service account invoking systemctl
  • systemd/journald or syslog records for service start, stop, enable, disable, and status activity
  • Service unit metadata and file-change evidence where systemctl execution is associated with Systemd Service behavior
  • Host inventory and role context to distinguish expected administration from unusual service activity

Detection direction

  • Validate that Linux endpoints and servers collect command-line process telemetry for systemctl, not just generic process names.
  • Tune detections against approved administration patterns, automation accounts, configuration management activity, and maintenance windows to reduce false positives.
  • Correlate systemctl activity with user identity, privilege level, parent process, host role, and service name rather than alerting on every use of the tool.
  • Review DET0073, the related detection strategy, as the ATT&CK-linked detection context, but confirm the strategy is implemented against local telemetry.
  • Watch for blind spots on minimal Linux builds, cloud workloads, container hosts, or servers where journald/syslog retention is short or command-line logging is incomplete.

Mitigation priorities

  • Apply User Account Management controls by limiting who can manage system services and enforcing least privilege for service-management permissions.
  • Review and remove stale, shared, or over-privileged Linux accounts that can invoke privileged service actions.
  • Require auditable administrative paths for service changes, including approved automation and change-control evidence where appropriate.
  • Harden monitoring and retention for Linux service-management logs on business-critical systems before relying on detections.
  • Use incident response playbooks that treat suspicious systemctl activity as execution context requiring validation of the invoking account, service, command, and host role.
Analyst notes and limits

The ATT&CK object is new in version 19.1 and has no official detection text. The relationship to TeamTNT indicates ATT&CK-documented use by that group, whose description references cloud and containerized environments, but this does not by itself establish current activity or exposure in any specific environment. The relationship to System Services and Systemd Service context is important for interpreting systemctl as service-based execution rather than merely a command-line utility.

This take is limited to the supplied ATT&CK fields, external reference, and relationships. It does not assert active exploitation, vendor coverage, or guaranteed detection. Local Linux architecture, logging configuration, privilege model, and administrative baselines are required to determine actual risk and monitoring quality.

Official MITRE ATT&CK definition

Systemctl

Adversaries may abuse systemctl to execute commands or programs. Systemctl is the primary interface for systemd, the Linux init system and service manager. Typically invoked from a shell, Systemctl can also be integrated into scripts or applications.

Adversaries may use systemctl to execute commands or programs as Systemd Services. Common subcommands include: `systemctl start`, `systemctl stop`, `systemctl enable`, `systemctl disable`, and `systemctl status`.[1]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Related techniques

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

1 rows
Domain ID Name Relationship / procedure
Enterprise T1569 System Services This object subtechnique of System Services.
Associated objects

Groups, software, and campaigns

Group Enterprise

G0139: TeamTNT

TeamTNT is a threat group that has primarily targeted cloud and containerized environments. The group as been active since at least October 2019 and has mainly focused its efforts on leveraging cloud and container resources to deploy cryptocurrency miners in victim environments.[1][2][3][4][5][6][7][8][9]

Relationship explorer

All related ATT&CK context

uses · Group G0139: TeamTNT Enterprise subtechnique of · Technique T1569: System Services Enterprise detects · Detection Strategy DET0073: Detection Strategy for System Services: Systemctl Enterprise mitigates · Mitigation M1018: User Account Management Enterprise
Mitigations

Mitigation direction

Mitigation Enterprise

M1018: User Account Management

User Account Management involves implementing and enforcing policies for the lifecycle of user accounts, including creation, modification, and deactivation. Proper account management reduces the attack surface by limiting unauthorized access, managing account privileges, and ensuring accounts are used according to organizational policies. This mitigation can be implemented through the following measures:

Enforcing the Principle of Least Privilege

- Implementation: Assign users only the minimum permissions required to perform their job functions. Regularly audit accounts to ensure no excess permissions are granted. - Use Case: Reduces the risk of privilege escalation by ensuring accounts cannot perform unauthorized actions.

Implementing Strong Password Policies

- Implementation: Enforce password complexity requirements (e.g., length, character types). Require password expiration every 90 days and disallow password reuse. - Use Case: Prevents adversaries from gaining unauthorized access through password guessing or brute force attacks.

Managing Dormant and Orphaned Accounts

- Implementation: Implement automated workflows to disable accounts after a set period of inactivity (e.g., 30 days). Remove orphaned accounts (e.g., accounts without an assigned owner) during regular account audits. - Use Case: Eliminates dormant accounts that could be exploited by attackers.

Account Lockout Policies

- Implementation: Configure account lockout thresholds (e.g., lock accounts after five failed login attempts). Set lockout durations to a minimum of 15 minutes. - Use Case: Mitigates automated attack techniques that rely on repeated login attempts.

Multi-Factor Authentication (MFA) for High-Risk Accounts

- Implementation: Require MFA for all administrative accounts and high-risk users. Use MFA mechanisms like hardware tokens, authenticator apps, or biometrics. - Use Case: Prevents unauthorized access, even if credentials are stolen.

Restricting Interactive Logins

- Implementation: Restrict interactive logins for privileged accounts to specific secure systems or management consoles. Use group policies to enforce logon restrictions. - Use Case: Protects sensitive accounts from misuse or exploitation.

*Tools for Implementation*

Built-in Tools:

- Microsoft Active Directory (AD): Centralized account management and RBAC enforcement. - Group Policy Object (GPO): Enforce password policies, logon restrictions, and account lockout policies.

Identity and Access Management (IAM) Tools:

- Okta: Centralized user provisioning, MFA, and SSO integration. - Microsoft Azure Active Directory: Provides advanced account lifecycle management, role-based access, and conditional access policies.

Privileged Account Management (PAM): - CyberArk, BeyondTrust, Thycotic: Manage and monitor privileged account usage, enforce session recording, and JIT access.

Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates .

ATT&CK release
19.1
Object version
1.0
Created
Modified
Raw hash
adb2dc1bcd6feaa7...
Imported snapshots across ATT&CK releases (1)
Release Bundle imported Object version Modified Status Raw hash
19.1 1.0 Current bundle adb2dc1bcd6f…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSON Open MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    Red Hat Systemctl 2022

    Damon Garn. (2022, May 17). How to use systemctl to manage Linux services. Retrieved March 18, 2025.

    Open source URL
  2. [2]
    mitre-attack T1569.003
    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK site Official STIX data repository MITRE ATT&CK terms of use