Systemd

This detection identifies potential persistence on Linux systems by monitoring for unauthorized file creation or modification within the /lib/systemd/system-generators/ directory, which executes during the boot sequence.

This brief details how attackers may leverage the `systemd-run` utility on Linux systems for defense evasion and execution by running commands as detached, transient services or scopes to obscure their activities and parent-child process chains.