diff --git a/src/detection/initsystem/initsystem_linux.c b/src/detection/initsystem/initsystem_linux.c
index d5fa8452a..cefe97d5b 100644
--- a/src/detection/initsystem/initsystem_linux.c
+++ b/src/detection/initsystem/initsystem_linux.c
@@ -1,7 +1,22 @@
 #include "initsystem.h"
 #include "common/processing.h"
+#include "util/linux/elf.h"
 #include <unistd.h>
 
+static bool elfExtractStringsCallBack(const char* str, uint32_t len, void* data)
+{
+    if (len > strlen("systemd 0.0 running in ") && memcmp(str, "systemd ", strlen("systemd ")) == 0)
+    {
+        const char* pend = memmem(str + strlen("systemd "), len - strlen("systemd "), " running in ", strlen(" running in "));
+        if (pend)
+        {
+            ffStrbufSetNS((FFstrbuf*) data, (uint32_t) (pend - str) - (uint32_t) strlen("systemd "), str + strlen("systemd "));
+            return false;
+        }
+    }
+    return true;
+}
+
 const char* ffDetectInitSystem(FFInitSystemResult* result)
 {
     const char* error = ffProcessGetBasicInfoLinux((int) result->pid, &result->name, NULL, NULL);
@@ -33,18 +48,22 @@ const char* ffDetectInitSystem(FFInitSystemResult* result)
     {
         if (ffStrbufEqualS(&result->name, "systemd"))
         {
-            if (ffProcessAppendStdOut(&result->version, (char* const[]) {
-                ffStrbufEndsWithS(&result->exe, "/systemd") ? result->exe.chars : "systemctl", // use exe path in case users have another systemd installed
-                "--version",
-                NULL,
-            }) == NULL && result->version.length)
+            ffElfExtractStrings(result->exe.chars, elfExtractStringsCallBack, &result->version);
+            if (result->version.length == 0)
             {
-                uint32_t iStart = ffStrbufFirstIndexC(&result->version, '(');
-                if (iStart < result->version.length)
+                if (ffProcessAppendStdOut(&result->version, (char* const[]) {
+                    ffStrbufEndsWithS(&result->exe, "/systemd") ? result->exe.chars : "systemctl", // use exe path in case users have another systemd installed
+                    "--version",
+                    NULL,
+                }) == NULL && result->version.length)
                 {
-                    uint32_t iEnd = ffStrbufNextIndexC(&result->version, iStart + 1, ')');
-                    ffStrbufSubstrBefore(&result->version, iEnd);
-                    ffStrbufSubstrAfter(&result->version, iStart);
+                    uint32_t iStart = ffStrbufFirstIndexC(&result->version, '(');
+                    if (iStart < result->version.length)
+                    {
+                        uint32_t iEnd = ffStrbufNextIndexC(&result->version, iStart + 1, ')');
+                        ffStrbufSubstrBefore(&result->version, iEnd);
+                        ffStrbufSubstrAfter(&result->version, iStart);
+                    }
                 }
             }
         }