evjawbreaker drop in /.solidity then systemd or LaunchAgent persistence

ills3c Intel&Coffee@Ills3C

•updated yesterday•0•0•0

Detects a sequence where a file is dropped into a hidden .solidity directory followed by the creation of a persistence artifact (such as a systemd user unit or macOS LaunchAgent) on the same device within one hour.