Persistence

Linux Backdoor Account Persistence

Covers techniques for detecting and preventing unauthorized backdoor accounts on Linux systems used to maintain persistent unauthorized access.

Linux Cron and Timer Persistence

Covers abusing cron jobs and systemd timers to maintain persistent access on Linux systems, including scheduled task backdoors and detection evasion.

Linux Shell and Profile Persistence

Techniques for maintaining persistent access on Linux systems via shell configuration files, profile scripts, and environment variable hijacking.

Linux SSH Authorized Keys Persistence

Covers abusing SSH authorized_keys files to maintain persistent backdoor access on Linux systems by injecting attacker-controlled public keys.

Linux Systemd Service Persistence

Covers creating malicious systemd service units to maintain persistent code execution across reboots, including unit file structure and enabling techniques.

Linux Web Shell Persistence

Covers techniques attackers use to deploy and maintain web shells on Linux servers for persistent backdoor access and remote code execution.