Hunting persistence on linux

Hunting Persistence on Linux

When to Use

• You have collected Linux persistence-relevant files (cron entries, systemd units, shell rc files, authorized_keys, autostart) and want to flag suspicious entries.
• You are triaging a suspected compromised Linux host's persistence surface.

Do not use this on a live root shell as a substitute for proper IR collection — feed it collected copies. It reads files statically and executes nothing.

Prerequisites

• Collected persistence artifacts (cron files, unit files, rc files, authorized_keys).

Safety & Handling

• Read files statically; treat their contents as untrusted.

Workflow

Step 1: Scan persistence files

python scripts/analyst.py scan /path/to/collected

Recursively scans known persistence locations and flags entries containing download/exec patterns (curl|wget ... | sh, base64 -d | bash, reverse-shell one-liners, nc -e), suspicious paths (/tmp, /dev/shm), and unexpected authorized_keys additions.

Step 2: Categorize by mechanism

Group findings by mechanism: cron, systemd, rc/profile, SSH keys, autostart.

Step 3: Confirm

Compare against a known-good baseline of expected services/keys; investigate deviations.

Step 4: Document

Record each persistence entry, its mechanism, and the suspicious indicator.

Validation

• Findings are grouped by persistence mechanism.
• Reverse-shell/download-exec one-liners are flagged with the matched pattern.
• authorized_keys additions are surfaced for review.

Pitfalls

• Legitimate admin cron/systemd entries — baseline before alerting.
• Persistence in less-common spots (udev, PAM, LD_PRELOAD) not covered by basic scans.
• Encoded/obfuscated payloads hiding the true command.

References

• See references/api-reference.md for the scanner.
• ATT&CK T1543.002 and T1053.003 (linked in frontmatter).