Persistence via systemd units, crontab, or macOS LaunchAgents
This rule detects various common methods of achieving persistence on Linux and macOS systems. It monitors file system changes to systemd unit files and macOS LaunchAgent plist files, as well as the execution of commands related to managing systemd services and user crontab entries.
Microsoft Sentinel (KQL)
