Lion Cipher Lab

Hunt Linux persistence from host telemetry (build the analytic from scratch)

• SOC Analyst / Blue Team
• Advanced
• ~80 min
• Free · no account required

Why it matters

An intruder who lands on a Linux host has one problem above all others: the box will reboot, the session will drop, the shell will die -- and if they have not planted something that re-executes on its own, they lose everything and have to break in again. So they establish PERSISTENCE: a mechanism that quietly re-runs their code on a schedule, at boot, at login, or inside every program that starts. This is not optional tradecraft; it is the load-bearing step of almost every real intrusion, which is exactly why MITRE ATT&CK devotes a whole tactic to it and catalogs dozens of Linux-specific…

What you'll learn

• what 'persistence' means and why survive-a-reboot mechanisms are the anchor an intruder cannot skip
• enumerating the major Linux persistence vectors: cron (system + cron.d + per-user), systemd services AND timers, shell init files, the dynamic linker (ld.so.preload / LD_PRELOAD), SUID/SGID, SSH authorized_keys, and rc.local
• generating a self-contained benign baseline plus three planted needles as pure test-data on your own machine (nothing attacked or deployed)
• writing a Python hunter that reads each vector's telemetry and scores it with simple, explainable heuristics (downloader-in-a-cron, hidden/temp paths, LD_PRELOAD injection, off-allow-list SUID)
• triaging findings into a ranked report and mapping every vector to its MITRE ATT&CK technique ID
• naming the false positives honestly: distro-shipped SUID (sudo, passwd), package systemd timers, legit backup cron jobs, known-good SSH keys
• the baseline-diff-vs-point-in-time tradeoff -- why the rogue SSH key hides in a point-in-time scan but jumps out against a snapshot
• the judgment of WHEN to hunt persistence instead of waiting for the payload, WHY these vectors re-execute, and HOW osquery / auditd / Velociraptor productionize this exact idea

Steps in this lab

1. What Linux persistence is, and why you hunt the anchors
2. Generate self-contained telemetry: a benign baseline plus three needles
3. Build the hunter (part 1): enumerate cron and systemd
4. Build the hunter (part 2): shell init, the linker, SUID, SSH keys, rc.local
5. Run it and watch the needles surface next to honest false positives
6. The baseline-diff round: point-in-time vs a clean snapshot
7. Map every vector to ATT&CK, and why persistence re-executes
8. The judgment: when to hunt persistence, and how the pros do it

Open the full interactive lab →