Cortex XDR:Source: XDR Analytics BIOC Category: Persistence Action: Detected Description: An uncommon service was started using systemctl or service processes.

[kajer@infosec.exchange]

Cortex XDR:

Source: XDR Analytics BIOC 
Category: Persistence 
Action: Detected 
Description: An uncommon service was started using systemctl or service processes. The command line used: systemctl restart containerd. This command line was not seen in the last 30 days in the organization