Linux Persistence File Creation via Python3 Paths for sysmon.py and systemd User Service

title: Linux Persistence File Creation via Python3 Paths for sysmon.py and systemd User Service
id: 455dc7eb-be50-4b4c-b0b9-04ee6a288ede
status: experimental
description: This rule flags file creation events where the source image path contains /python3 and the target filename ends with .config/sysmon/sysmon.py or .config/systemd/user/sysmon.service. Such artifacts indicate an attacker attempting to establish persistence through user-level components, making it a valuable signal for compromise investigation. It relies on Linux file event telemetry capturing the creating process path (Image) and the created file path (TargetFilename).
references:
  - https://novasky.io/hunts/hunting-litellm-supply-chain
  - https://www.virustotal.com/gui/file/71e35aef03099cd1f2d6446734273025a163597de93912df321ef118bf135238/
  - https://huskyhacks.io/posts/litellm-cred-stealer/
  - https://www.wiz.io/blog/threes-a-crowd-teampcp-trojanizes-litellm-in-continuation-of-campaign
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2026/TA/TeamPCP/file_event_lnx_teampcp_litellm_supply_chain_attack_indicators.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2026-03-30
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.t1543.002
  - attack.initial-access
  - attack.t1195.002
  - detection.emerging-threats
logsource:
  category: file_event
  product: linux
detection:
  selection:
    Image|contains: /python3
    TargetFilename|endswith:
      - /.config/sysmon/sysmon.py
      - /.config/systemd/user/sysmon.service
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 81c0b7f5-81c9-435e-a291-bc32fc2b72cd
    type: derived