Linux Suspicious systemd-run Transient Service Persistence
Detects attackers creating transient systemd units via systemd-run to persist malware or reverse shells outside normal unit files. Linux malware families including cryptominers and botnets use --remain-after-exit and custom unit names under /tmp or /dev/shm to survive logout while evading static service file inspection.
Sigma
