Linux:

Persistence

Cron, SSH keys, web shells, backdoors, systemd, and profile persistence

6 guides • Created Apr 4, 2026 • Updated Apr 30, 2026

6 guides

Linux Backdoor Account Persistence

Covers techniques for detecting and preventing unauthorized backdoor accounts on Linux systems used to maintain persistent unauthorized access.

Apr 4, 2026 • 5 min read

Linux Cron and Timer Persistence

Covers abusing cron jobs and systemd timers to maintain persistent access on Linux systems, including scheduled task backdoors and detection evasion.

Apr 4, 2026 • 4 min read

Linux Shell and Profile Persistence

Techniques for maintaining persistent access on Linux systems via shell configuration files, profile scripts, and environment variable hijacking.

Apr 4, 2026 • 4 min read

Linux SSH Authorized Keys Persistence

Covers abusing SSH authorized_keys files to maintain persistent backdoor access on Linux systems by injecting attacker-controlled public keys.

Apr 4, 2026 • 4 min read

Linux Systemd Service Persistence

Covers creating malicious systemd service units to maintain persistent code execution across reboots, including unit file structure and enabling techniques.

Apr 4, 2026 • 1 min read

Linux Web Shell Persistence

Covers techniques attackers use to deploy and maintain web shells on Linux servers for persistent backdoor access and remote code execution.

Apr 4, 2026 • 5 min read

Linux persistence ensures you maintain access to a compromised system across reboots and user sessions. Techniques range from simple cron jobs and SSH authorized key additions to more advanced methods like malicious systemd services, init script modifications, LD_PRELOAD hijacking, and PAM backdoors.

The subpages cover each persistence mechanism, when to use it, and how to keep it from being easily detected during incident response.