Suspicious systemd timer activity

Synopsis

Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	1 Day
Required Data	Requires: XDR Agent
Detection Modules
ATT&CK Tactic	Execution (TA0002) Persistence (TA0003) Privilege Escalation (TA0004)
ATT&CK Technique	Scheduled Task/Job: Systemd Timers (T1053.006)
Severity	Low

Suspicious systemd timer activity, which may indicate an attempt to establish persistence.

An adversary may use systemd timers to execute malicious code at system startup or on a scheduled basis for persistence.

Check the systemd timer file change and try to understand the impact of the systemd timers change.