Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
ATT&CK technique

T1053.006

Systemd Timers

ExecutionPersistencePrivilege Escalation 6 detections found
View on MITRE ATT&CK →

Detection rules

Source Rule Status Updated
elastic Modification of Persistence Relevant Files Detected via Defend for Containers production 2026-09-18
elastic Systemd Timer Created production 2026-09-18
splunk Linux Auditd Service Restarted production 2026-05-13
splunk Linux Service File Created In Systemd Directory production 2026-05-13
splunk Linux Service Restarted production 2026-05-13
splunk Linux Service Started Or Enabled production 2026-05-13