All Detections

Udev Rule Modified for Linux Persistence

avatar
Darshan Thummar@Mighty
updated Jun 27, 2026001

Detects modification of udev rules for persistent command execution on device events

Microsoft Sentinel (KQL)