HighCompromise indicatorsBLWK-PERSIST-002

systemd unit posts to a messaging API on start

What this means

The systemd unit “‹unit name›” shells out to curl against a chat/ messaging API on start (“‹exec start›”). This exact pattern is used to notify an attacker (e.g. of a new SSH tunnel URL) every time the service restarts — treat it as exfiltration infrastructure unless you recognize it as your own notification script.

How to fix it

Review the unit file under /etc/systemd/system/ and disable it if you didn't create it.

Check it yourself

Run a scan and look for BLWK-PERSIST-002 in the results:

bulwark scan

Installed the standalone CLI package instead of the app? The command is bulwarkctl.

How Bulwark decides

Bulwark reads systemd_units and reports this check when:

exec_start contains "curl" and exec_start matches "telegram|discord.com/api/webhooks|slack.com/api"

If a value can't be read, Bulwark reports the check as undetermined rather than passing it. View the rule source.

References

• MITRE ATT&CK T1041
• MITRE ATT&CK T1071.001

Related checks

• Shell history recording is suppressed · BLWK-EVASION-001
• File modified since baseline: ‹path› · BLWK-FIM-001
• File deleted since baseline: ‹path› · BLWK-FIM-002
• Not covered by the file-integrity baseline: ‹path› · BLWK-FIM-003
• Credential file modified since baseline: ‹path› · BLWK-FIM-004
• Credential file deleted since baseline: ‹path› · BLWK-FIM-005