T1543.002: SleepyDuck evjawbreaker Linux systemd user unit persistence

Tim Peck@timpeck

•updated today•1•0•25

Detects SleepyDuck evjawbreaker Go RAT Linux persistence: a systemd user unit solidity-langsupport-runner.service written under ~/.config/systemd/user and enabled via systemctl --user from a /bin/sh -lc shell, within a short window on the same host.