hunt attacker persistence before they come back tomorrow

why persistence is the thing that ruins your good day

you found the malware. you deleted it. you feel good. then tomorrow it's back, running like nothing happened. that's persistence doing its job. attackers don't want to re-exploit you every time, so the second they get a foothold they plant a few ways to survive a reboot, a cleanup, even a full malware scan. if you only kill the payload and skip the hunt for persistence, you didn't actually kick them out. you just annoyed them for a few hours.

windows: the four places to check first

windows gives attackers a lot of legit-looking real estate to hide in. these are the classics, and they're the classics for a reason, they work.

run keys in the registry launch a program every time a user logs in. check both HKCU\Software\Microsoft\Windows\CurrentVersion\Run and the HKLM version, since one is per-user and one is machine-wide.

scheduled tasks are a favorite because they can run as SYSTEM, run silently, and have names like "AdobeUpdateCheck" that nobody questions. open task scheduler and actually read the trigger and the action, not just the name.

services get abused the same way. a malicious service set to auto-start looks boring in a list of 150 other services, which is exactly the point.

autoruns from sysinternals is the fastest way to see all of the above (plus browser extensions, drivers, winlogon hooks, and more) in one window, sorted and cross-checked against microsoft's signature database. it's free and it should be on every defender's flash drive.

autorunsc64.exe -a * -c -h -s > autoruns_output.csv

that dumps everything to a csv so you can diff it later, which matters more than people think.

linux: fewer gui tools, same idea

linux persistence hides in plainer text, which is good news for you.

cron jobs, check /etc/crontab, /etc/cron.d/, and every user's crontab with crontab -l -u username. a one-liner that curls a script and pipes it to bash at 3am is not a normal backup job.

systemd units are the modern equivalent of services. look in /etc/systemd/system/ and ~/.config/systemd/user/ for anything you didn't create, especially units set to enable on boot.

shell profiles like .bashrc, .bash_profile, and /etc/profile.d/ get a quiet one-line addition that runs every time someone opens a terminal. check the bottom of these files first, that's where attackers usually append.

the real trick: baseline first, compare later

here's the part most people skip and it's the part that actually makes this work. you cannot spot "weird" if you don't know what "normal" looks like on your own system. take a snapshot of your run keys, scheduled tasks, services, cron jobs, and startup files while the machine is clean. store it somewhere safe. when something feels off later, you're not squinting at a giant list trying to guess, you're diffing two files and the new entry jumps right out.

# windows, baseline then compare
autorunsc64.exe -a * -c -h -s > baseline.csv
autorunsc64.exe -a * -c -h -s > current.csv
fc baseline.csv current.csv

# linux, baseline then compare
crontab -l > cron_baseline.txt
diff cron_baseline.txt <(crontab -l)

this is the same logic incident responders use on client networks, just scaled down to one machine. no fancy tooling required, just discipline about capturing "known good" before you need it.

the red flag that shows up everywhere

whatever platform you're on, watch for unsigned binaries sitting in temp folders, appdata, or /tmp. legit software almost never installs itself in a temp directory and calls it home permanently. if you find an exe or script in one of those spots that's set to auto-launch and has no valid signature, that's your persistence mechanism, go pull the thread.

the takeaway

malware removal without a persistence hunt is just a temporary win. go build your baseline this week, before anything is wrong, so you actually have something to compare against when it matters. check run keys, tasks, services, cron, systemd, and shell profiles on a regular schedule, not just when something feels broken. the goal isn't paranoia, it's making sure that when they knock once, they don't get a key to come back.