Analytics BIOC Low
✕

An uncommon service was started

An uncommon service was started using systemctl or service processes.

Module:
Platform Analytics
Data source:
XDR Agent
ATT&CK tactics: Persistence (TA0003) Privilege Escalation (TA0004)
ATT&CK techniques: Create or Modify System Process: Systemd Service (T1543.002)
Detector tags: Kubernetes - AGENT Containers
Attacker's goals:

Attackers may create systemd services to run malicious payloads.

Investigative actions:

Check whether the executing process is benign and if this was a desired behavior as part of its normal execution flow.

Test period:
N/A (single event)
Deduplication:
1 Day
1 variation:
  • An uncommon service was started in a Kubernetes pod Low