TeamPCP Malicious Trivy sysmon.py Systemd Persistence

Elgonad .@elgonad

•updated Mar 23, 2026•1•0•86

Detects the creation of a malicious Python script (`sysmon.py`) within the user's systemd directory. This specific file and path are utilized by the TeamPCP compromised Trivy binary to establish persistence on developer machines when the GITHUB_ACTIONS environment variable is not set to "true".