Malicious systemd unit disguised as Apache HTTPD Cache Manager
Detects the creation and enablement of a systemd unit file that uses a deceptive description ('Apache HTTPD Cache Manager') and the 'Restart=always' directive. This pattern is characteristic of persistence mechanisms used by the Evooo1Bot malware, which attempts to maintain continuous execution by running as a system service.
Microsoft Sentinel (KQL)
