Sigma medium test sigma

Systemd Service Creation

Detects a creation of systemd services which could be used by adversaries to execute malicious code.

View Source

Detection Logic

{
  "path": {
    "type": "PATH",
    "nametype": "CREATE"
  },
  "name_1": {
    "name
| startswith": [
      "/usr/lib/systemd/system/",
      "/etc/systemd/system/"
    ]
  },
  "name_2": {
    "name
| contains": "/.config/systemd/user/"
  },
  "condition": "path and 1 of name_*"
}

False Positives

  • ⚠ Admin work like legit service installs.

Field Validations

Loading…

Comments (0)

Loading comments...