Lion Cipher Lab
Find Linux scheduled persistence in cron, systemd timers and at spools
- Digital Forensics & IR (DFIR)
- Intermediate
- ~75 min
- Free · no account required
Why it matters
An intruder who gets onto a Linux server usually wants to come back after a reboot or after you kill their process, and the easiest way is to ask the system to run something for them on a schedule. Linux has at least five different schedulers, each storing its jobs in different files, and the command most people reach for -- crontab -l -- shows exactly one of them, for one user at a time. Responders who stop there clean up one job and leave four running. On top of that, the schedulers follow rules that surprise people: a script in /etc/cron.daily with a dot in its name never runs at all, and…
What you'll learn
- Mapping every place a Debian-family Linux system schedules work: /etc/crontab, /etc/cron.d, the run-parts directories, per-user crontab spools, anacron, systemd timers (system and per-user) and at jobs
- Applying the rules that decide whether a scheduled entry actually runs: the user field, the % character, SHELL, and run-parts file-name rules
- Writing a standard-library Python inventory that reads a mounted image copy offline and never executes anything from it
- Using dpkg file lists to separate package-owned scheduler files from files nobody installed
- Measuring how much a per-user crontab -l view misses against a full inventory
- Turning file modification times into a first timeline, and naming why that timeline is weak evidence
Steps in this lab
- What scheduled persistence is, and why you look offline
- The map: five schedulers and where each keeps its jobs
- The rules that decide whether a job actually runs
- Build the image copy
- Write the inventory: one parser per scheduler
- Run it and read the inventory row by row
- Measure the four views: what crontab -l actually misses
- Three rows that are not what they look like
- Turn modification times into a first timeline
- Honest limits of this method
- Optional: the same sweep on a live Linux machine you own
- The judgment: when to reach for this, and how to do it better