Stealth Execution and Persistence Mechanisms
This detects an AI coding/automation agent being used to run commands that hide their output, install software that survives reboots, and move files off the machine covertly. Together these actions are classic signs of an attacker settling in for the long term on a compromised system.
How the attack works
An attacker with control over an agent's task or a malicious 'skill'/plugin gets it to run commands in the background with output suppressed (for example using nohup) so the operator does not notice unusual activity. The agent is then directed to install persistence, such as enabling a systemd service or installing an npm package globally, so the attacker's code keeps running after a restart or session end. Finally the agent uses scp or similar to pull data out or push additional tools in, without going through visible, logged channels. The combination of hidden execution, persistence, and covert transfer is what distinguishes this from routine admin work.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- d5d22c76-79b2-4d58-b8c2-60cd316ab306
- Severity
- High
Why it matters
An attacker can maintain long-term access to a compromised host through an AI agent, run hidden background processes, and exfiltrate data, all without the operator noticing anything abnormal in the session output.
What you can do
- →Review what services, packages, and scheduled/persistent jobs your AI agents are permitted to install, and require explicit approval for systemctl enable or global package installs.
- →Log and alert on agent-initiated background processes (nohup, output redirection) rather than trusting silent success.
- →Restrict or monitor outbound file transfer commands like scp from agent execution environments, and prefer allow-listed, logged transfer channels.
- →Audit third-party 'skills' or plugins used by the agent for embedded persistence or stealth-execution instructions before deployment.
Known benign look-alikes
- System administration skills that legitimately manage services
- Deployment tools that install global CLI packages
- Backup tools that use scp for remote file transfer