Malicious udev Rule for Persistence
Detects the creation or modification of udev rules that execute suspicious commands or scripts from unusual locations. Udev rules are used by the Linux kernel device manager to handle hardware events and can be abused for persistence.
Splunk (SPL)
