Systemd Timer Unit File Dropped via Web Shell

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•2

This rule detects attempts to drop a systemd timer unit file via a web shell. It specifically looks for HTTP POST requests (flow:to_server) containing both '.timer' and '[Timer]' in the client body, indicating the creation or modification of a systemd timer unit.