Nexcorium Systemd Persistence

Elgonad .@elgonad

•updated Apr 27, 2026•0•134

Detects file creation or modification events targeting /etc/systemd/system/persist.service, or the execution of 'systemctl enable persist'. This persistence mechanism is used by the Nexcorium Mirai variant to ensure the botnet survives reboots.