Linux masquerading systemd service or 5-minute cron persistence (SysGoRAT-style)

Kush rana@Kushblueteamer

•updated 3 days ago•0•0•1

Detects Linux persistence mechanisms involving potentially masqueraded systemd service/timer creation combined with subsequent systemctl enable actions, as well as suspicious cron job entries using common download utilities or interpreter flags.