Linux systemd user service persistence via ~/.config/systemd/user

Emiliano Mema@Nosalva

•updated Aug 21, 2026•1•0•4

Detects the creation, modification, or renaming of systemd service files within a user's configuration directory (~/.config/systemd/user/). The rule further correlates these file events with the execution of 'systemctl --user' commands to enable or start these services, which is a common pattern for establishing user-level persistence on Linux systems.