analyzing-linux-persistence

Analyzing Linux Persistence

Linux persistence mechanisms are spread across dozens of locations that no single tool checks comprehensively. The attacker needs only one you miss. The work is a systematic sweep of every initialization path the kernel and userspace honor, in a sequence that catches the common before the exotic.

When to Use

• Investigating a compromised Linux host to find how the attacker kept access
• Forensic analysis of a Linux disk image or live system
• Looking for backdoors, unauthorized services, or rogue scheduled tasks
• Determining the full scope of attacker modifications during IR
• Validating that eradication removed every persistence mechanism

When NOT to Use

• Running a full incident response -- use responding-to-incidents
• Establishing persistence offensively -- use establishing-persistence
• Actively escalating privileges -- use escalating-linux-privileges
• The host is Windows -- use investigating-windows-endpoints
• You have an acquired disk image, not a live host -- use analyzing-disk-images
• Analyzing a recovered malware sample -- use analyzing-malware

Systemd Units

Systemd is the most common persistence vector on modern Linux. Check every search path, not just /etc/systemd/system.

Search paths (evaluated in priority order):

/etc/systemd/system/          # admin-installed, highest priority
/run/systemd/system/          # runtime units, survive until reboot
/usr/lib/systemd/system/      # package-installed defaults
/usr/local/lib/systemd/system/
~/.config/systemd/user/       # per-user units (no root needed)

Enumeration:

# All enabled units -- compare against a known-good baseline
systemctl list-unit-files --state=enabled --type=service
systemctl list-unit-files --state=enabled --type=timer

# Recently modified service files
find /etc/systemd /run/systemd /usr/lib/systemd ~/.config/systemd \
  -name '*.service' -o -name '*.timer' -o -name '*.socket' \
  2>/dev/null | xargs ls -lt | head -30

# Show the full contents of a suspect unit
systemctl cat suspicious.service

# Check for drop-in overrides that modify legitimate units
find /etc/systemd/system/*.d /run/systemd/system/*.d \
  -name '*.conf' 2>/dev/null

# Masked units -- attacker may mask a security service
systemctl list-unit-files --state=masked

# Systemd generators -- scripts that dynamically create units at boot.
# Four directories, in ascending precedence. Checking only the first two
# misses generators dropped in the others.
ls -la /etc/systemd/system-generators/
ls -la /run/systemd/system-generators/         # tmpfs: runtime-injected
ls -la /usr/local/lib/systemd/system-generators/
ls -la /usr/lib/systemd/system-generators/