chkconfig / systemctl

systemctl list-unit-files --type=service --state=enabled

Lists services enabled at boot, the baseline inventory to detect new services or persistence via systemd.

Run it as part of the baseline for each host and the periodic persistence review: the list of enabled services is the snapshot of what starts with the system. Compared to the baseline, any new service is an anomaly — and persistence via systemd (unit files in /etc/systemd/system) is one of the favorite paths for attackers with root on Linux. In an IR, the first question after confirming compromise is 'what has been installed to survive reboot?', and this list, cross-referenced with newly created unit files, is the answer. It also catches legitimate software that sneaks in (agents, miners) that admins didn't approve.

Don't use it as complete persistence detection: systemd is one path, but there are others (cron, rc.local, profile.d, .bashrc, LD_PRELOAD) that this list doesn't see — the persistence inventory needs multiple sources. The enabled list only shows units that start: a service created and started manually without enabling (systemctl start without enable) doesn't appear, even if it's running. And watch out: on hosts with many packages, the list is long; the practical filter is the unit files in /etc/systemd/system (those from manual administration), not those in /usr/lib/systemd/system (those from packages).