Linux Persistence File Creation Targeting sysmon.py and systemd user service
Alerts on creation of user persistence files under sysmon.py or systemd user service paths by a process running from /python3.
- Product
- linux
- Category
- file_event
- Author
- Swachchhanda Shrawan Poudel (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2026-03-30
- Updated
- 2026-07-31
ATT&CK techniques
Initial Access → Priv EscRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags file creation events where the executing image path contains '/python3' and the target filename ends with either '/.config/sysmon/sysmon.py' or '/.config/systemd/user/sysmon.service'. Such persistence-related drops matter because attackers can use Python-launched activity to write a backdoor entrypoint or a user-level systemd service for recurring execution. The detection relies on Linux file event telemetry that includes the process image path and the targeted filename.
Reporting behind it
- novasky.iohttps://novasky.io/hunts/hunting-litellm-supply-chain
- virustotal.comhttps://www.virustotal.com/gui/file/71e35aef03099cd1f2d6446734273025a163597de93912df321ef118bf135238/
- huskyhacks.iohttps://huskyhacks.io/posts/litellm-cred-stealer/
- wiz.iohttps://www.wiz.io/blog/threes-a-crowd-teampcp-trojanizes-litellm-in-continuation-of-campaign
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2026/TA/TeamPCP/file_event_lnx_teampcp_litellm_supply_chain_attack_indicators.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Linux Persistence File Creation Targeting sysmon.py and systemd user service
id: 455dc7eb-be50-4b4c-b0b9-04ee6a288ede
status: experimental
description: This rule flags file creation events where the executing image path contains '/python3' and the target filename ends with either '/.config/sysmon/sysmon.py' or '/.config/systemd/user/sysmon.service'. Such persistence-related drops matter because attackers can use Python-launched activity to write a backdoor entrypoint or a user-level systemd service for recurring execution. The detection relies on Linux file event telemetry that includes the process image path and the targeted filename.
references:
- https://novasky.io/hunts/hunting-litellm-supply-chain
- https://www.virustotal.com/gui/file/71e35aef03099cd1f2d6446734273025a163597de93912df321ef118bf135238/
- https://huskyhacks.io/posts/litellm-cred-stealer/
- https://www.wiz.io/blog/threes-a-crowd-teampcp-trojanizes-litellm-in-continuation-of-campaign
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2026/TA/TeamPCP/file_event_lnx_teampcp_litellm_supply_chain_attack_indicators.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2026-03-30
tags:
- attack.persistence
- attack.privilege-escalation
- attack.t1543.002
- attack.initial-access
- attack.t1195.002
- detection.emerging-threats
logsource:
category: file_event
product: linux
detection:
selection:
Image|contains: /python3
TargetFilename|endswith:
- /.config/sysmon/sysmon.py
- /.config/systemd/user/sysmon.service
condition: selection
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: 81c0b7f5-81c9-435e-a291-bc32fc2b72cd
type: derived