Velvet Ant Operation Highland - Malicious systemd Service Installation

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

This rule detects potential persistence mechanisms on Linux systems by identifying the creation of new systemd service files, modifications to init.d scripts, or the use of systemctl to enable or start services. The rule specifically excludes standard package management activities (apt, yum, dnf, dpkg) and flags if the triggered service operation involves suspicious file paths.