huntrule

Linux Persistence File Creation Targeting sysmon.py and systemd user service

Alerts on creation of user persistence files under sysmon.py or systemd user service paths by a process running from /python3.

FreeReviewedSigma · High · v5
Product
linux
Category
file_event
Author
Swachchhanda Shrawan Poudel (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2026-03-30
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Initial Access → Priv Esc

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags file creation events where the executing image path contains '/python3' and the target filename ends with either '/.config/sysmon/sysmon.py' or '/.config/systemd/user/sysmon.service'. Such persistence-related drops matter because attackers can use Python-launched activity to write a backdoor entrypoint or a user-level systemd service for recurring execution. The detection relies on Linux file event telemetry that includes the process image path and the targeted filename.

Reporting behind it

Related detections9 linkedT1195.002 — drag to rearrange
Linux Process Creation Indicators for LiteLLM Backdoored Package Activity (v1.82.7/v1.82.8)
Malicious Shai-Hulud Self-Hosted GitHub Runner Registration via Process Creation
Suspicious Google Workspace OAuth Authorization for Chrome Web Store Scope via Token Audit
Malicious Shai-Hulud npm Worm Marker via SHA1HULUD Process Name (via process_creation)
Malicious Systemd Service Masquerading as Sd-Pam Helper
Malicious Shai-Hulud Self-Hosted GitHub Actions Runner Named SHA1HULUD (via process_creation)
Suspicious npm Package Spawning cURL Download via Process Creation
Malicious Linux systemd Persistence nvmconf.service
Suspicious Linux Persistence via sed Edit of Boot and Init Files
Linux Persistence File Creation Targeting sysmon.py and systemd user service
Pivot detection · T1195.002 · 9 related

Changelog

v5
  1. v5
    Candidate ingested via manual entry.2026-07-31
  2. v4
    Candidate ingested via manual entry.2026-07-31
  3. v3
    Candidate ingested via manual entry.2026-07-31
  4. v2
    Candidate ingested via manual entry.2026-07-31
  5. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.