Identifier / Programs / Linux and Unix
systemd-run
Run programs in transient scope units, service units, or path-, socket-, or timer-triggered service units. tldr-pages
GTFOBins shell 1 ATT&CK technique 3 documented commands
How systemd-run is abused
shell T1059.004 Command and Scripting Interpreter: Unix Shell
-Sshell T1059.004 Command and Scripting Interpreter: Unix Shell
-tEach abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for systemd-run.
3 documented commands
command with sudo
systemd-run /path/to/commandshell with sudo
systemd-run -Sshell with sudo
systemd-run -t /bin/shNone of the 3 commands the identifier reads trips a Sigma process-creation rule. These commands are from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for systemd-run. The identifier reads the line of each that runs systemd-run.
What detects it
Everyday use
Start a transient service
sudo systemd-run command argument1 argument2 ...IdentifyStart a transient service under the service manager of the current user (no privileges)
systemd-run --user command argument1 argument2 ...IdentifyStart a transient service with a custom unit name and description
sudo systemd-run --unit name --description string command argument1 argument2 ...IdentifyNone of the 3 examples the identifier reads matches GTFOBins abuse or trips a Sigma process-creation rule.