Lesson 4.5: Malicious systemd services
systemd starts everything on a modern Linux system, which makes a service unit an attractive hiding place: it runs as root, restarts itself if killed, and survives reboots. How to tell a real service from an impostor (where its unit file and program live, what it connects to, whether a package owns it), and how to stop and remove it in the right order while keeping evidence. In the lab you investigate a service with a convincing name that runs a hidden program from /var/tmp and talks to the same outside server as in the last lesson.
17 min
You will learn to
- Explain why services are used for persistence
- Inspect a unit with systemctl status and cat
- Spot red flags: location, network connections, no owning package
- Collect evidence and hashes
- Stop, disable and remove a malicious unit
Key terms
- Unit file
- A text file that tells systemd how to run a service: the program, the user, restart rules, when to start.
- daemon-reload
- Makes systemd re-read unit files after they are added, changed or removed.
- Command and control (C2)
- The channel malware uses to receive instructions and send data out.
- Indicator of compromise (IOC)
- An observable sign of an intrusion: a file hash, an IP address, a domain, a file path.
- Masquerading
- Giving malicious files or services names and places that look legitimate.
← TCP: the three-way handshake, flags and connection states · All lessons · Cross-site scripting (XSS) →