Domaine 04

Persistance

Un attaquant qui entre veut rester. Ce domaine associe chaque emplacement de persistance Linux courant à son chemin sur disque, à la façon de l'énumérer sur un hôte actif ou une image, et à la technique MITRE ATT&CK correspondante.

/etc/cron.d/
/etc/systemd/system/
/etc/ld.so.preload

Guides de ce domaine

Ces guides sont pour l'instant publiés en anglais uniquement. Les liens ci-dessous ouvrent la version anglaise.

04 · PersistanceAnglais

Hunting Linux Persistence: Cron, systemd, SSH and More

Where attackers hide persistence on Linux (cron, systemd units and timers, shell startup files, SSH keys, ld.so.preload, PAM, udev, modules) and how to find it.

persistencecronsystemd

28 sept. 2026

Fiches artefacts

Emplacement de chaque artefact, ce qu'il prouve, ses horodatages et les outils pour l'analyser.

Cron, anacron, at et timers systemd : planificationArtefacts de planification Linux (crontabs, horodatages anacron, tâches at, timers systemd) qui révèlent la persistance planifiée et prouvent les exécutions.
Unités systemd : persistance des services LinuxFichiers service, timer et drop-in systemd, liens d'activation, générateurs et lingering : où sont définis les services Linux et comment repérer la persistance.
Artefacts SSH : authorized_keys, known_hosts, logs sshdArtefacts OpenSSH sous Linux (authorized_keys, known_hosts, configuration, clés d'hôte, logs sshd) : accès distant, persistance par clé et mouvement latéral.
/etc/ld.so.preload et LD_PRELOAD : détournement du linkerFichier de préchargement de l'éditeur de liens, LD_PRELOAD et ld.so.conf : comment les rootkits userland injectent des bibliothèques et comment les repérer.
Shell Startup Files: Linux bashrc and profile PersistenceSystem and per-user shell startup files (profile, bashrc, zshrc, logout) on Linux: load order, where attackers hide persistence and how to review them.
rc.local, SysV init.d and MOTD Scripts: Linux Boot HooksLegacy Linux boot and login script locations (rc.local, /etc/init.d, rc?.d links, Upstart jobs, update-motd.d) and how they reveal persistence.
Linux Kernel Modules: lsmod, Taint Flags and Boot ConfigLoaded and configured Linux kernel modules (/proc/modules, /sys/module, modules-load.d, modprobe.d, taint flags) for spotting rootkits and module persistence.
udev and USB Device History on LinuxReconstruct USB device connections on Linux from kernel, udisks and USBGuard logs, and check udev rules used for RUN+= persistence.
XDG Autostart .desktop Entries: Linux Desktop PersistenceXDG autostart entries in /etc/xdg/autostart and ~/.config/autostart that launch programs at every graphical login, plus KDE and X session hooks.
PAM Configuration and Modules: Linux Auth BackdoorsLinux PAM stacks in /etc/pam.d and the pam_*.so modules they load: where attackers plant password loggers and master passwords, and how to verify them.
SUID, SGID and File Capabilities: Linux Privilege BackdoorsSUID/SGID bits and file capabilities (security.capability) on Linux: how attackers plant root backdoors and how to baseline them against packages.
eBPF Programs and Pinned Maps: Linux Kernel ImplantsLoaded eBPF programs, pinned objects in /sys/fs/bpf and their loaders on disk: how eBPF rootkits and BPF backdoors hide on Linux and how to find them.
sysctl, Boot Parameters and binfmt_misc on LinuxLinux kernel settings in sysctl.d, /proc/sys and the boot command line: core_pattern and modprobe hijacks, weakened protections, ip_forward, binfmt_misc.
Web Shells in the Web Root: Finding Them on Linux ServersWhere Linux web roots live per distro, how PHP, JSP and CGI web shells and .htaccess or module backdoors look on disk, and how to date and hunt them.
/etc/hosts, nsswitch.conf and resolv.conf on LinuxLinux name resolution files as evidence: /etc/hosts redirects, resolv.conf and systemd-resolved DNS changes, and NSS module backdoors in nsswitch.conf.
logrotate State and Log Gaps: Detecting Linux Log Tamperinglogrotate configuration and state files on Linux: how rotation shapes what logs survive, how to tell normal rotation from deletion, and postrotate persistence.
cloud-init Logs and Instance Data: Linux Cloud VM Forensicscloud-init on Linux cloud VMs: cloud-init.log, output log, user-data, per-instance state and boot scripts that record provisioning, SSH keys and persistence.

Tous les domaines