Persistence Mechanism Installation

How the attack works

An attacker (or a compromised/manipulated agent) gains the ability to run shell commands or edit files. It then either runs a command that adds a cron entry, creates a launchd or systemd unit file, or edits a shell startup file such as .bashrc or .profile. It could also use a file-editing tool to write directly to one of these same locations. Once in place, the entry runs automatically on every login, reboot, or scheduled interval, giving the attacker a way back in without repeating the initial compromise. A companion rule looks for the same file writes at the EDR level for cases where the agent-level command isn't visible.

Netzilo detection

Why it matters

An attacker who reaches this step no longer needs to re-exploit the original entry point; they get a standing foothold that survives reboots and session restarts, which extends dwell time and makes cleanup harder.

What you can do

• →Review new cron entries, launch agents, systemd units, and shell profile changes on hosts where AI agents have shell or file-editing access.
• →Restrict which directories and files agent tools are allowed to write to, especially startup and scheduling locations.
• →Alert on any agent-initiated changes to cron, launchd, systemd, or shell profile files rather than allowing silent writes.
• →Maintain a baseline of expected scheduled tasks and startup entries so unexpected additions stand out.

Known benign look-alikes

• Legitimate cron job setup for scheduled tasks
• System administrators configuring launch agents for authorised services
• Developers adding shell aliases and PATH entries to startup files

References

• https://attack.mitre.org/techniques/T1053/
• https://attack.mitre.org/techniques/T1543/
• https://attack.mitre.org/techniques/T1546/

Related threats