Linux Service Reload or Start via systemctl/service
Detects the start or reload of a service on Linux systems using 'systemctl' or 'service' commands. This can be indicative of persistence mechanisms or privilege escalation attempts where adversaries modify or create services to execute malicious payloads.
Sigma
