Systemd override.conf persistence for gtwk_module agent
This rule detects the creation or modification of systemd override configuration files, specifically looking for files named 'override.conf' or 'gtwk_module.conf' within directories under '/etc/systemd/system/'. The logic is specifically tuned to identify persistence mechanisms targeting the systemd service manager, including activity associated with the 'rsyslog.service.d' path, which is indicative of the gtwk_module agent attempting to persist across system reboots.
Microsoft Sentinel (KQL)
