https://aegrah.github.io/categories/persistence.htmlRecent content in Persistence on RGROSECHugo -- gohugo.ioenCopyright © Ruben GroenewoudTue, 25 Feb 2025 12:00:00 +0200https://aegrah.github.io/post/2025-02-25-linux-detection-engineering-grand-finale-on-linux-persistence-mechanisms.htmlTue, 25 Feb 2025 12:00:00 +0200https://aegrah.github.io/post/2025-02-25-linux-detection-engineering-grand-finale-on-linux-persistence-mechanisms.html In the fifth and final part of the Linux Persistence Detection Engineering series, we bring the journey to its grand finale by exploring some of the most obscure, creative, and complex persistence mechanisms. Building on the foundational concepts covered in previous publications, this final installment focuses on techniques rooted in the Linux boot process, authentication systems, inter-process communication, and core utilities. We begin with GRUB-based persistence and the manipulation of initramfs, demonstrating both manual modifications and automated approaches using Dracut.https://aegrah.github.io/post/2025-02-11-linux-detection-engineering-approach-the-summit-on-persistence-mechanisms.htmlTue, 11 Feb 2025 12:00:00 +0200https://aegrah.github.io/post/2025-02-11-linux-detection-engineering-approach-the-summit-on-persistence-mechanisms.html In the fourth part of the Linux Persistence Detection Engineering series, I continue exploring advanced Linux persistence techniques, expanding on the foundation set in previous publications. This latest installment delves into additional creative and complex methods adversaries use to maintain persistence on Linux systems. We explore the abuse of Pluggable Authentication Modules (PAM), specifically how pam_exec can be leveraged to execute malicious code during authentication events. We also analyze installer package manipulation via RPM and DPKG, where lifecycle scripts are weaponized to establish persistence through package installations and updates.https://aegrah.github.io/post/2025-01-27-linux-detection-engineering-continuation-on-persistence-mechanisms.htmlMon, 27 Jan 2025 12:00:00 +0200https://aegrah.github.io/post/2025-01-27-linux-detection-engineering-continuation-on-persistence-mechanisms.html In the third part of the Linux Persistence Detection Engineering series, I continue exploring advanced Linux persistence techniques, expanding on the foundation set in previous publications. This latest installment dives into more creative and complex persistence methods, providing security researchers and defenders with a deeper understanding of how adversaries maintain access on Linux systems. We explore techniques such as dynamic linker hijacking, where adversaries manipulate the dynamic linker through LD_PRELOAD to execute malicious code persistently.https://aegrah.github.io/post/2024-08-29-linux-detection-engineering-sequel-on-persistence-mechanisms.htmlThu, 29 Aug 2024 12:00:00 +0200https://aegrah.github.io/post/2024-08-29-linux-detection-engineering-sequel-on-persistence-mechanisms.html In this second part of the Linux Persistence Detection Engineering series, I explore the world of more advanced Linux persistence techniques. This part builds upon the knowledge obtained from the previous persistence blog dubbed "Linux Detection Engineering - A Primer on Persistence Mechanisms". This sequel aims to equip defenders and security researchers with a more comprehensive understanding of Linux persistence. With the help of PANIX, a Linux persistence tool I developed, we will simulate these techniques, analyze the logs and observe detection opportunities.https://aegrah.github.io/post/2024-08-21-linux-detection-engineering-primer-on-persistence-mechanisms.htmlFri, 23 Aug 2024 12:00:00 +0200https://aegrah.github.io/post/2024-08-21-linux-detection-engineering-primer-on-persistence-mechanisms.html In this first installment of the Linux Persistence Detection Engineering series, I delve into Linux persistence mechanisms, exploring both common and complex techniques to enhance the knowledge of defenders and security researchers. I examine how these persistence methods operate, how to set them up, and most importantly, how to detect and hunt for them effectively. With the help of PANIX, a Linux persistence tool I developed, I’ll demonstrate practical examples and detection strategies, ensuring you gain a solid understanding of these crucial techniques.