Detects Linux persistence by unauthorized use of a systemd generator placed in system generator directories (e.g., /lib/systemd/system-generators/). Systemd generators run early in the boot sequence to dynamically create or modify unit files; attackers can place a malicious generator to ensure code execution on every startup, enabling persistence or backdoor access after reboots. The analytic relies on endpoint telemetry (EDR) mapped to the Endpoint.Filesystem data model and uses a Splunk tstats search that filters for file creation or modification events under lib/systemd/system-generators. When such an event is observed, the rule surfaces intermediate findings including the target file and user, along with process identifiers, and calculates first/last seen times. The rule is categorized under Linux persistence techniques and maps to MITRE ATT&CK techniques T1037.005 (System Generator) and T1547 (Boot or Logon Autostart). Known false positives include legitimate admin activity or software deployments that intentionally place custom generators; mitigate by correlating with known software inventories and verified administrative actions. The rule includes drilldown searches and reference material to aid investigation and validation, and is supported by a test dataset representing true positives of Linux persistence via system generators.