Systemd Persistence

Quick notes on systemd services and timers as Linux persistence mechanisms.

2026-09-12

1 min read

linuxpersistencesystemdservicesenumerationred-team

Systemd Persistence Locations#

Common locations: /etc/systemd/system/ /usr/lib/systemd/system/ /lib/systemd/system/ Custom services under /etc/systemd/system/ deserve attention.

Systemd timers can trigger services at scheduled intervals. Useful commands: systemctl list-timers --all systemctl list-unit-files --type=service

systemd enumeration

TTY1ZSH 5.9

r41n@0xraiven:~$>systemctl list-unit-files --type=service

r41n@0xraiven:~$>systemctl list-timers --all

r41n@0xraiven:~$>systemctl --type=service --state=running

r41n@0xraiven:~$>ls -la /etc/systemd/system/

r41n@0xraiven:~$>

Findings

INFO

Suspicious Services Look for: • Unknown services • Services pointing to unusual paths • Executables under /tmp or user-writable directories • Unexpected services running as root • Recently created or modified unit files • Suspicious ExecStart commands

inspect a service

TTY1ZSH 5.9

r41n@0xraiven:~$>systemctl cat <service-name>

r41n@0xraiven:~$>systemctl show <service-name> -p ExecStart -p User

r41n@0xraiven:~$>

Takeaway#

When investigating Linux persistence, don't just list running services. Inspect how they start, what they execute, where the executable lives, and which user runs it.

Back to Notesnote: systemd-persistence