Lesson 5 of 12 · Investigation
Hunting persistence: systemd, cron, ld.so.preload, shell profiles
Objective
Once you have found how the attacker got in, make sure they cannot come back: review every place where a program or command can relaunch itself, and build the list of what to remove.
This lesson is part of the full course
Unlock Linux Incident Response and Digital Forensics to read every lesson, do the exercises, access the simulations and earn your certificate.
Already enrolled? Log in.