Velvet Ant - Systemd Chrome Service Persistence (T1543.002)

Ibrahim Saud@tektrix

•updated Jun 20, 2026•0•0•2

Detects the creation of systemd unit files masquerading as Google Chrome components used to launch the GS-Netcat backdoor on boot.