Systemd Timer Created via Remote SSH

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•5

This rule detects the creation of a systemd timer via a remote SSH session. It specifically looks for TCP traffic on port 22 (SSH) containing the commands 'systemctl enable' and '.timer' (case-insensitive), indicating an attempt to enable a systemd timer unit.