Area 04

Persistence

Attackers who get in want to stay in. This area maps every common Linux persistence location to where it lives on disk, how to enumerate it on a live host or an image, and the matching MITRE ATT&CK technique.

/etc/cron.d/
/etc/systemd/system/
/etc/ld.so.preload

Guides in this area

04 · Persistence

Hunting Linux Persistence: Cron, systemd, SSH and More

Where attackers hide persistence on Linux (cron, systemd units and timers, shell startup files, SSH keys, ld.so.preload, PAM, udev, modules) and how to find it.

persistencecronsystemd

Sep 28, 2026

Artifact cheat sheets

Where each artifact lives, what it proves, its timestamps and the tools to parse it.

Cron, Anacron, at and systemd Timers: Linux SchedulingLinux scheduled task artifacts (crontabs, anacron stamps, at spool jobs, systemd timers) that reveal scheduled persistence and prove when jobs ran.
systemd Unit Files: Linux Service Persistencesystemd service, timer and drop-in files, enablement symlinks, generators and user lingering: where Linux services are defined and how they reveal persistence.
SSH Artifacts: authorized_keys, known_hosts and sshd LogsOpenSSH artifacts on Linux (authorized_keys, known_hosts, configs, host keys, sshd logs) that prove remote access, key persistence and lateral movement.
/etc/ld.so.preload and LD_PRELOAD: Linux Linker HijackingThe dynamic linker preload file, LD_PRELOAD and ld.so.conf: how userland rootkits inject libraries into every process and how to detect them.
Shell Startup Files: Linux bashrc and profile PersistenceSystem and per-user shell startup files (profile, bashrc, zshrc, logout) on Linux: load order, where attackers hide persistence and how to review them.
rc.local, SysV init.d and MOTD Scripts: Linux Boot HooksLegacy Linux boot and login script locations (rc.local, /etc/init.d, rc?.d links, Upstart jobs, update-motd.d) and how they reveal persistence.
Linux Kernel Modules: lsmod, Taint Flags and Boot ConfigLoaded and configured Linux kernel modules (/proc/modules, /sys/module, modules-load.d, modprobe.d, taint flags) for spotting rootkits and module persistence.
udev and USB Device History on LinuxReconstruct USB device connections on Linux from kernel, udisks and USBGuard logs, and check udev rules used for RUN+= persistence.
XDG Autostart .desktop Entries: Linux Desktop PersistenceXDG autostart entries in /etc/xdg/autostart and ~/.config/autostart that launch programs at every graphical login, plus KDE and X session hooks.
PAM Configuration and Modules: Linux Auth BackdoorsLinux PAM stacks in /etc/pam.d and the pam_*.so modules they load: where attackers plant password loggers and master passwords, and how to verify them.
SUID, SGID and File Capabilities: Linux Privilege BackdoorsSUID/SGID bits and file capabilities (security.capability) on Linux: how attackers plant root backdoors and how to baseline them against packages.
eBPF Programs and Pinned Maps: Linux Kernel ImplantsLoaded eBPF programs, pinned objects in /sys/fs/bpf and their loaders on disk: how eBPF rootkits and BPF backdoors hide on Linux and how to find them.
sysctl, Boot Parameters and binfmt_misc on LinuxLinux kernel settings in sysctl.d, /proc/sys and the boot command line: core_pattern and modprobe hijacks, weakened protections, ip_forward, binfmt_misc.
Web Shells in the Web Root: Finding Them on Linux ServersWhere Linux web roots live per distro, how PHP, JSP and CGI web shells and .htaccess or module backdoors look on disk, and how to date and hunt them.
/etc/hosts, nsswitch.conf and resolv.conf on LinuxLinux name resolution files as evidence: /etc/hosts redirects, resolv.conf and systemd-resolved DNS changes, and NSS module backdoors in nsswitch.conf.
logrotate State and Log Gaps: Detecting Linux Log Tamperinglogrotate configuration and state files on Linux: how rotation shapes what logs survive, how to tell normal rotation from deletion, and postrotate persistence.
cloud-init Logs and Instance Data: Linux Cloud VM Forensicscloud-init on Linux cloud VMs: cloud-init.log, output log, user-data, per-instance state and boot scripts that record provisioning, SSH keys and persistence.

All areas