services-persistence-general-detect

Persistence Recon

Purpose: Systematic enumeration of all persistence mechanisms across all layers. Baseline comparison and delta reporting for every vector.

---

Core Focus Areas

• Userland: cron, systemd units/timers, shell RC files (.bashrc/.profile/.zshrc), XDG autostart
• Scheduled tasks: at jobs, anacron, systemd timers, incron
• Authentication hooks: PAM modules, SSH authorized_keys, SSH RC files, sudo rules
• Package manager hooks: pacman hooks, dpkg pre/post-install scripts, rpm scriptlets
• udev rules: Rules executing commands on device insertion
• Kernel-level: LKMs (signed/unsigned), eBPF programs, kprobes, pinned BPF objects
• Firmware/boot: UEFI boot entries, GRUB config, initramfs hooks, ACPI SSDT injection
• Library injection: /etc/ld.so.preload, LD_PRELOAD in env, rpath manipulation

---

Key Techniques & Tools

Systemd Services & Timers

# All enabled services (compare against PersistenceBaseline)
systemctl list-unit-files --type=service --state=enabled 2>/dev/null | sort

# Recently modified service files
find /etc/systemd/system /usr/libs/systemd/system \
  -name "*.service" -newer /tmp/baseline_marker 2>/dev/null | head -20

# Service files with suspicious ExecStart patterns
grep -r "ExecStart\|ExecStartPre" \
  /etc/systemd/system/*.service /usr/libs/systemd/system/*.service 2>/dev/null | \
  grep -iE "(\bbash\b|\bsh\b|python|perl|ruby|nc\b|ncat|curl|wget|/tmp/|/dev/shm/)" | head -20

# All active timers
systemctl list-timers --all 2>/dev/null | head -20

# User-level systemd units (per-user persistence)
find /home /root -path "*/systemd/user/*.service" \
  -o -path "*/systemd/user/*.timer" 2>/dev/null | head -10

Cron & Scheduled Tasks

# Root crontab
crontab -l 2>/dev/null

# All user crontabs
for user in $(cut -f1 -d: /etc/passwd); do
  crontab -u "$user" -l 2>/dev/null | grep -v "^#\|^$" | \
    awk -v u="$user" '{print u": "$0}'
done

# System cron directories
ls -la /etc/cron.d/ /etc/cron.daily/ /etc/cron.hourly/ \
  /etc/cron.weekly/ /etc/cron.monthly/ 2>/dev/null

# /etc/crontab
cat /etc/crontab 2>/dev/null | grep -v "^#\|^$"

# at/anacron jobs
atq 2>/dev/null
ls /var/spool/at/ 2>/dev/null

# Anacron
cat /etc/anacrontab 2>/dev/null | grep -v "^#\|^$"

Shell RC & Profile Files

# System-wide profile files
cat /etc/profile 2>/dev/null | grep -v "^#\|^$"
grep -r "." /etc/profile.d/ 2>/dev/null | grep -v "^Binary\|^#" | head -30

# All user shell RC files
for rc in ~/.bashrc ~/.bash_profile ~/.profile ~/.zshrc ~/.zprofile \
          ~/.zshenv ~/.config/fish/config.fish; do
  [ -f "$rc" ] || continue
  echo "=== $rc ($(stat -c '%Y' "$rc" | date -d @$(cat) '+%Y-%m-%d %H:%M:%S' 2>/dev/null)) ==="
  grep -v "^#\|^$" "$rc" | head -10
done

# Check all users' RC files
find /home /root -maxdepth 2 -name ".bashrc" -o -name ".zshrc" \
  -o -name ".profile" -o -name ".bash_profile" 2>/dev/null | \
  while read f; do
    mod=$(stat -c "%Y" "$f" 2>/dev/null)
    recent=$(( $(date +%s) - 2592000 ))  # 30 days
    [ "$mod" -gt "$recent" ] && echo "RECENTLY MODIFIED: $f"
  done

# XDG autostart
ls /etc/xdg/autostart/ ~/.config/autostart/ 2>/dev/null | \
  while read f; do cat "/etc/xdg/autostart/$f" 2>/dev/null | grep "Exec="; done

PAM & SSH Persistence

# PAM module list (look for unknown modules)
find /libs*/security /usr/libs*/security -name "*.so" 2>/dev/null | sort

# PAM configuration — custom modules
grep -r "pam_" /etc/pam.d/ 2>/dev/null | \
  grep -v "pam_unix\|pam_env\|pam_permit\|pam_deny\|pam_nologin\|\
pam_securetty\|pam_faillock\|pam_limits\|pam_systemd\|pam_keyinit" | head -20

# All authorized_keys files
find /home /root /etc -name "authorized_keys" \
  -o -name "authorized_keys2" 2>/dev/null | while read f; do
  echo "=== $f ==="
  wc -l "$f"
  cat "$f"
done

# SSH RC file (executes on connection)
find /home /root -name ".ssh/rc" 2>/dev/null
find /etc/ssh -name "sshrc" 2>/dev/null

# SSH known_hosts (pivot infrastructure)
find /home /root -name "known_hosts" 2>/dev/null | while read f; do
  echo "$f: $(wc -l < "$f") hosts"
done

Package Manager Hooks

# Pacman hooks (Arch)
ls /etc/pacman.d/hooks/ /usr/share/libalpm/hooks/ 2>/dev/null | head -20
cat /etc/pacman.d/hooks/*.hook 2>/dev/null | grep -E "Exec\|Type\|Operation" | head -20

# ALPM scriptlets in installed packages (pre/post install)
for pkg in $(pacman -Qq 2>/dev/null | head -50); do
  pacman -Qi "$pkg" 2>/dev/null | grep -E "(Install Script|install)" | \
    grep -v "N/A" | awk -v p=$pkg '{print p": "$0}'
done | head -20

# dpkg/apt triggers (Debian)
ls /var/libs/dpkg/triggers/ 2>/dev/null | head -10

udev Rules

# All udev rules — look for RUN+= commands
grep -r "RUN+=" /etc/udev/rules.d/ /usr/libs/udev/rules.d/ 2>/dev/null | \
  grep -v "^Binary" | head -20

# Recently added udev rules
find /etc/udev/rules.d/ -newer /tmp/baseline_marker 2>/dev/null | head -10

# Suspicious udev rules (shell execution on device insertion)
grep -r "RUN+=.*bash\|RUN+=.*sh\|RUN+=.*python\|RUN+=.*curl\|RUN+=.*wget\|RUN+=.*nc" \
  /etc/udev/rules.d/ /usr/libs/udev/rules.d/ 2>/dev/null | head -10

Kernel-Level Persistence

# Loaded kernel modules vs baseline
lsmod 2>/dev/null | sort > /tmp/modules_live.txt
diff ./cybersec-shared/baselines/kernel.md /tmp/modules_live.txt 2>/dev/null | head -20

# Auto-loaded modules (kernel module parameters)
ls /etc/modules-load.d/ 2>/dev/null
cat /etc/modules 2>/dev/null | grep -v "^#\|^$"
find /usr/libs/modules-load.d/ -name "*.conf" 2>/dev/null | xargs cat 2>/dev/null

# eBPF pinned programs (persistent eBPF)
find /sys/fs/bpf -type f 2>/dev/null | head -20

# eBPF programs (bpftool)
bpftool prog list 2>/dev/null | head -20

# Library preload persistence
cat /etc/ld.so.preload 2>/dev/null && echo "⚠ ld.so.preload FOUND"
find /etc/ld.so.conf.d/ -name "*.conf" -newer /tmp/baseline_marker 2>/dev/null | head -5

Library & Linker Injection

# /etc/ld.so.preload (global library injection — rootkit technique)
[ -f /etc/ld.so.preload ] && cat /etc/ld.so.preload && \
  echo "🔴 CRITICAL: /etc/ld.so.preload exists"

# Dynamic linker config
cat /etc/ld.so.conf 2>/dev/null
ls /etc/ld.so.conf.d/ 2>/dev/null

# Writable entries in ld.so.conf.d
ls -la /etc/ld.so.conf.d/ 2>/dev/null | \
  awk 'NR>1 && $3 != "root" {print "WRITABLE: " $0}'

# Python persistence (sitecustomize.py, usercustomize.py)
python3 -c "import sys; print('\n'.join(sys.path))" 2>/dev/null | \
  while read p; do
    [ -f "$p/sitecustomize.py" ] && echo "SITECUSTOMIZE: $p/sitecustomize.py"
    [ -f "$p/usercustomize.py" ] && echo "USERCUSTOMIZE: $p/usercustomize.py"
  done

---

MITRE ATT&CK Mapping

Finding	Technique
Malicious cron job	T1053.003 – Cron
Unauthorized systemd service	T1543.002 – Systemd Service
Shell RC file modified	T1546.004 – Unix Shell Configuration Modification
/etc/ld.so.preload modified	T1574.006 – Dynamic Linker Hijacking
Rogue PAM module	T1556.003 – Pluggable Authentication Modules
Unauthorized SSH authorized_keys	T1098.004 – SSH Authorized Keys
Kernel module persistence	T1547.006 – Kernel Modules and Extensions
eBPF pinned persistence	T1547.015 – Login Items (equiv.)
Malicious udev rule	T1037 – Boot or Logon Initialization Scripts
UEFI/initramfs persistence	T1542.001 / T1542.003
XDG autostart entry	T1547.013 – XDG Autostart Entries

---

Rules for Agents

1. Always load PersistenceBaseline at start — ALL deltas = at least MEDIUM
2. /etc/ld.so.preload exists = CRITICAL — escalate immediately
3. New kernel module not in baseline = HIGH
4. eBPF pinned to /sys/fs/bpf = HIGH — dump and analyse
5. Unauthorized SSH authorized_keys = HIGH
6. Log every persistence mechanism with path, owner, creation date, and content hash to iocs.md
7. Always cross-validate with @kernel-analyst for LKM/eBPF findings
8. Sync all persistence IOCs to shared memory at session end