Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/T1053.006_systemd-timers
Adversaries may abuse systemd timers to perform task scheduling for initial or recurring execution of malicious code.
Passed 21 of 23 test cases with the skill, and 20 of 23 without it.
1 fixed20 passed either way2 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
A test case the skill fixed. Same model, same prompt, with and without the skill.
A system administrator wants to apply MITRE M1018 (User Account Management) to prevent low-privilege users from scheduling transient tasks without unit files. Which specific Linux management tools should have access restricted?
| Checked | Without skill | With skill |
|---|---|---|
| Recommends limiting access to systemctl and systemd-run utilities | Missed | Passed |
The instructions your model reads when the skill loads.
Sub-technique of: T1053
Adversaries may abuse systemd timers to perform task scheduling for initial or recurring execution of malicious code. Systemd timers are unit files with file extension .timer that control services. Timers can be set to run on a calendar event or after a time span relative to a starting point. They can be used as an alternative to Cron in Linux environments. Systemd timers may be activated remotely via the systemctl command line utility, which operates over SSH.
Each .timer file must have a corresponding .service file with the same name, e.g., example.timer and example.service. .service files are Systemd Service unit files that are managed by the systemd system and service manager. Privileged timers are written to /etc/systemd/system/ and /usr/lib/systemd/system while user level are written to ~/.config/systemd/user/.
An adversary may use systemd timers to execute malicious code at system startup or on a scheduled basis for persistence. Timers installed using privileged paths may be used to maintain root level persistence. Adversaries may also install user level timers to achieve user level persistence.
Platforms: Linux
The following tests are from Atomic Red Team and provide actionable ways to test this technique:
This test creates Systemd service and timer then starts and enables the Systemd timer
Supported Platforms: linux Elevation Required: Yes
test cases passed, vs 20 / 23 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.