TeamPCP Systemd Persistence Drop

Brandon Rodriguez@BMRodriguez

•updated Mar 25, 2026•17•0•290

This rule detects the creation of specific files associated with the TeamPCP malware's systemd persistence mechanism. It looks for the creation of '/.config/sysmon/sysmon.py' or '/.config/systemd/user/sysmon.service' which are used to maintain access and download further stages via C2 even if the original vulnerable litellm process terminates.