Velvet Ant Operation Highland: Malicious systemd Service Persistence (T1543.002)

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

Detects potential persistence via the creation of suspicious systemd service files. The rule monitors for new service files created by non-package manager processes, correlates these with subsequent 'systemctl enable' or 'start' operations, and identifies the execution of binaries from non-standard directories (e.g., /tmp, /dev/shm) by the systemd process.