Systemd

This detection identifies potential persistence on Linux systems by monitoring for unauthorized file creation or modification within the /lib/systemd/system-generators/ directory, which executes during the boot sequence.

This brief outlines how Linux cgroups, a kernel feature for resource management, can be repurposed to provide valuable telemetry for detecting malicious processes, particularly in systemd, Docker, and Kubernetes environments, aiding in investigations of server compromises.