Unit 9: Scheduled tasks and persistence · Lesson 5 of 6 · 18 min
Hunting persistence
Sweep the system for files changed in the suspicious window and list every way back in.
mission
- You are
- You are making sure nothing was missed.
- Situation
- You found four changes one by one. An attacker may have made more. A time-window search finds them all at once.
- Goal
- Search the config and program folders for anything changed on 13 October between 22:00 and midnight.
- Hand in
- A complete list of persistence items.
Search the window
find /etc /usr/local /opt -newermt '2026-10-13 22:00' ! -newermt '2026-10-14 00:00' -type f 2>/dev/null
/etc/systemd/system/kthreadd-helper.service
/etc/cron.d/.sync-check
/etc/profile.d/proxy.sh
/usr/local/lib/.cache/kthreadd
you should see Exactly the four items from the sudo log. Nothing else changed in that window.
defender tip Attackers can reset timestamps with touch. A window search is fast and usually right, but hashes against a baseline are stronger.
Look for hidden names
find /etc /usr/local /opt -name '.*' 2>/dev/null
/etc/cron.d/.sync-check
/etc/cron.d/.placeholder
/etc/.pwd.lock
/etc/skel/.bashrc
/etc/skel/.bash_logout
/etc/skel/.profile
/etc/cron.daily/.placeholder
/etc/cron.yearly/.placeholder
/etc/cron.monthly/.placeholder
/etc/cron.hourly/.placeholder
/etc/cron.weekly/.placeholder
/usr/local/lib/.cache
you should see Package placeholders and skeleton files are normal. Two hidden names are not.
Where persistence hides on Linux
| Command | What it does |
|---|---|
/etc/cron.d, crontabs | Scheduled and @reboot jobs |
/etc/systemd/system | Services and timers |
/etc/profile.d, .bashrc | Code run at login |
~/.ssh/authorized_keys | Keys that log in |
/etc/passwd | Extra accounts, extra UID 0 |
Search contents, not just names
Once you know one artefact's name, search for every file that mentions it.
grep -rl 'sync-agent' /etc 2>/dev/null
/etc/cron.d/.sync-check
you should see Only the hidden cron file mentions it: that is what restarts the listener.
What a defender takes away
- 1Search by time window once you know when.
- 2Hidden names in system folders deserve a look.
- 3List every way back in before anyone starts cleaning up.
Questions
0 of 2 solved
Answer each one from what you find on your lab machine.