Phantom Bot Systemd Service Persistence
Detects Linux persistence mechanisms specifically associated with the creation or execution of the 'phantom-bot.service' systemd service, used by the axois-utils phantom bot to execute DDoS attacks. The rule looks for process creation events on Linux where the command line contains 'phantom-bot.service' and the process name is 'sh', 'bash', 'systemctl', or 'node'.
Cortex XDR
