title: Watcher-NetAI — user-systemd persistence unit
id: 7a9e2c80-3d8f-4f1d-9c7a-1a4e5d8b0c01
status: experimental
description: |
  Detects creation of the per-user systemd unit file that the Watcher-NetAI cluster
  drops as its non-root persistence path. The unit name and the unit body content
  are unique to this cluster as of search date 2026-05-14.
author: OHIIHO Research
date: 2026-05-14
references:
  - Watcher-NetAI / skn public report, OHIIHO Research, 2026-05-14
tags:
  - attack.persistence
  - attack.t1543.002
logsource:
  category: file_event
  product: linux
detection:
  sel_unit:
    TargetFilename|endswith:
      - '/.config/systemd/user/watcher-netai.service'
  sel_wants_symlink:
    TargetFilename|endswith:
      - '/.config/systemd/user/default.target.wants/watcher-netai.service'
  condition: 1 of sel_*
fields:
  - User
  - TargetFilename
  - Image
falsepositives:
  - No known benign use of this exact unit name. Validate against environments with custom user-systemd services.
level: high
