Title:
Service Reload or Start - Linux
Status:
test
Description:Detects the start, reload or restart of a service.
References:
-https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1543.002/T1543.002.md
Author: Jakob Weinzettl, oscd.community, CheraghiMilad
Date: 2019-09-23
modified:2025-03-03
Tags:
- -'attack.privilege-escalation'
- -'attack.persistence'
- -'attack.t1543.002'
Logsource:
- product: linux
- service: auditd
Detection:
selection:
type:
'EXECVE'
a0|contains:
-'systemctl'
-'service'
a1|contains:
-'reload'
-'start'
condition:
selection
Falsepositives:
-Installation of legitimate service.
-Legitimate reconfiguration of service.
-Command line contains daemon-reload.
Level:
low
