Ethical Hacking & Penetration Testing

Linux Persistence

Detect startup, cron, SSH keys, accounts, FIM, and rootkit indicators — then recover safely.

Eight defensive labs on synthetic Linux images: systemd/startup persistence, cron hunts, rogue authorized_keys, UID-0/backdoor accounts, FIM triage for trust-file changes, rootkit indicator response, post-compromise investigation order, and recovery/hardening after confirmed footholds. Focus is detection, evidence preservation, and remediation — not stealthy malware deployment.

Level: Advanced
Duration: 4–6 weeks
Modules: 4 modules · 8 lessons
Learning method: Lessons + labs

Preview first lesson

What you will learn

Triage suspicious systemd units and preserve evidence before removal
Hunt unauthorized cron jobs and remediate without destroying artifacts
Detect and revoke rogue authorized_keys with auth.log correlation
Spot UID-0 and unauthorized account/sudoers changes
Prioritize FIM alerts on cron, systemd, and SSH trust paths
Respond to rootkit-like indicators with memory/disk preservation
Run a structured post-compromise persistence investigation
Recover via known-good rebuild, credential rotation, and re-baselined FIM

Course curriculum

Expand each module for lessons, progress, and labs assigned to that module — not a flat topic dump.

Module 1

Startup and cron persistence

Detect systemd/startup hooks and unauthorized cron jobs; preserve then remediate.

0/2 lessons

Lessons

1. Systemd and Startup Persistencepreview~20 min
2. Cron Persistence Hunt~20 min

Module labs

Enrol to unlock full lessons and track module progress.

Module 2

SSH keys and account changes

Rogue authorized_keys and UID-0 / privilege change detection.

0/2 lessons

Lessons

1. SSH Authorized Keys Persistence~20 min
2. Account and Privilege Change Detection~20 min

Module labs

Enrol to unlock full lessons and track module progress.

Module 3

FIM and rootkit indicators

Prioritize integrity alerts and evidence-safe rootkit triage.

0/2 lessons

Lessons

1. FIM for Persistence Paths~20 min
2. Rootkit Indicator Triage~20 min

Module labs

Enrol to unlock full lessons and track module progress.

Module 4

Investigation and recovery

Structured post-compromise hunts and rebuild/harden packages.

0/2 lessons

Lessons

1. Post-Compromise Persistence Investigation~20 min
2. Recovery and Hardening After Persistence~20 min

Module labs

Enrol to unlock full lessons and track module progress.

Inside this course

Labs · Quizzes · Certificate

Labs below are curated for this syllabus (shared engine, course-specific assignments). They unlock with enrol; quizzes match course topics; finish ≈90%+ to claim a CYNARKS Academy certificate.

Course labs

8 assigned labs · free with this course enrol

Startup Persistence DetectionUnlock via course or plan
Cron Persistence HuntUnlock via course or plan
SSH Authorized Keys PersistenceUnlock via course or plan
Account & Privilege Change DetectionUnlock via course or plan
File Integrity Monitoring for PersistenceUnlock via course or plan
Rootkit Indicator TriageUnlock via course or plan
Post-Compromise Persistence InvestigationUnlock via course or plan
Recovery & Hardening After PersistenceUnlock via course or plan

Track quiz

99 questions matched to this course topics

Knowledge checks for this track only — not a separate global quiz menu.

Start track quiz

CYNARKS certificate

Educational completion certificate · verify by ID

Your progress: 0% · enrol to unlock claim

Enrol in this course first.