Rule Info
Name
SUSP_JS_Systemd_Persistence_Mar26
Author
Marius Benthin
Description
Detects JavaScript writing systemd service configuration to disk
Score
70
Date
2026-03-23
Minimum Yara
3.5.0
Rule Hash
af61acced505e49692769592f037311b
Tags
['T1569_002', 'T1059_007', 'SUSP']
Required Modules
[]
Antivirus Verdicts
Rating
Number of Samples
Malicious (>= 10 engines)
6
Suspicious (< 10 engines)
6
Clean (0 engines)
11
Rule Matches
Timestamp
Positives
Total
Hash
VT
Rule Matches per Month (last 24 months)
Scan your endpoints, forensic images or collected files with our portable scanner THOR