Linux persistence: a defender’s review

The defensive problem

Persistence allows an attacker to regain execution or access after an initial compromise. Reviewing it requires attention to both familiar startup paths and less obvious execution mechanisms.

My note was prompted by John Hammond’s Black Hat USA 2025 material and approaches the topic from prevention, detection and removal.

Practical perspective

A useful review separates the execution mechanism, the privileges it requires, the evidence it leaves and the conditions under which it returns.

Removing one suspicious entry is not equivalent to establishing that a system is trustworthy. Investigation, scope assessment and recovery decisions need to account for the original compromise.

The linked material is for authorized defensive learning and testing. It is not a report of a specific client incident.