Hunting Persistence on macOS and Linux: Where Attackers Hide and How to Find Them
Summary
Most persistence hunting content is written for Windows. Here is the macOS and Linux equivalent: LaunchAgents, login items and BTM, systemd, cron, shell profiles, ld.so.preload, SSH keys and udev, with hunting commands and accurate ATT&CK mappings.
Summary written automatically in our own words from the original article, which belongs to its publisher and remains the reference. It may contain errors. Sources & data