Detection of Linux Persistence via Systemd Generators

Attackers may establish persistence on Linux systems by creating or modifying files within the /lib/systemd/system-generators/ directory. Systemd generators are specialized executables run by the systemd manager early in the system boot sequence to dynamically generate unit files for service orchestration. By placing a custom script or binary in this directory, an adversary ensures that their payload is executed with high privileges every time the system starts. This technique allows for stealthy persistence that survives standard reboots and provides a mechanism to manipulate the system state before other security services may be fully initialized. Monitoring this directory is critical for detecting unauthorized configuration changes and potential lateral movement or backdoor deployment.

Impact

Successful exploitation allows an adversary to maintain long-term, high-privileged access to compromised Linux hosts. This can lead to full system compromise, data exfiltration, or the deployment of additional malicious modules that survive typical incident response remediation steps like service restarts, necessitating deep forensic analysis of the boot process to eradicate the threat.

Recommendation

• Deploy the provided Sigma rule to detect file modifications in systemd generator directories using Sysmon for Linux telemetry.
• Establish a baseline of known-good systemd generator files and alert on any new file creation in /lib/systemd/system-generators/ not associated with official package management activity (e.g., apt, yum, dnf).
• Enable Sysmon for Linux File Event logging (Event ID 11) specifically targeting critical system configuration paths.
• Integrate these detections into the SOC's incident response workflow to trigger immediate investigation of the user context and parent process responsible for the file modification.