Velvet Ant - GS-Netcat Persistence via systemd or init.d on Linux
Detects the creation or modification of files within /etc/systemd/system/ or /etc/init.d/ by non-standard management processes. Attackers often use these paths to establish persistence by creating or altering service unit files to execute malicious code automatically upon system boot or service restart. The rule specifically excludes common system management tools.
Cortex XDR
