Agent Persistence via Scheduler, Shell Init or Account Manipulation

How the attack works

An AI agent with shell or file access is directed (via a compromised prompt, malicious tool output, or a hijacked task) to run a command or write a file that sets up persistence. This can take several forms: adding a crontab or scheduled task entry, installing or enabling a systemd unit or launchd agent, writing an init.d/rc.local script, appending a download-and-run payload to a shell startup file like .bashrc, or creating/promoting a local user account. The rule only counts actual executed commands or genuine file writes with real content — not text that merely mentions these techniques in documentation, chat, or an LLM's written answer. For shell startup files specifically, it only fires when the appended content also includes a download or execution indicator (e.g. curl, wget, base64 decode, chmod +x), to avoid flagging harmless environment setup.

Netzilo detection

Why it matters

If successful, an attacker or a misused agent gains a foothold that runs automatically on schedule, reboot, or login, letting them regain access or re-run malicious code even after the initial session ends.

What you can do

• →Restrict which agents/service accounts can write to crontab, systemd unit directories, launchd paths, init scripts, or shell rc files.
• →Review any agent-initiated user creation or group membership changes, especially additions to administrative/sudo groups.
• →Separate legitimate DevOps/provisioning agents (Ansible, Terraform, deployment bots) from general-purpose agents so persistence-like actions from the latter stand out.
• →Alert on shell rc file writes that include download-and-execute patterns (curl|wget piped to a shell, base64 decode, chmod +x) rather than blocking all rc file edits.

Known benign look-alikes

• DevOps/SRE agents provisioning infrastructure - systemctl enable <unit> and cron.d drop-in installation are the normal way to deploy a daemon. Expect this on any server-configuration or deployment agent; scope the rule to developer workstations or tune per-agent before escalating past report.
• Dotfile and environment-bootstrap agents that append PATH/nvm/pyenv/rbenv init lines to .zshrc or .bashrc. Suppressed unless the appended payload also carries a download or execution indicator, but a bootstrap script that legitimately runs curl to install a version manager will still match.
• Configuration-management tooling driven through the agent (Ansible, Chef, Puppet, Salt, Terraform local-exec) that creates service accounts with useradd or manages unit files as part of a normal converge run.
• Container image build steps executed through the agent - Dockerfile RUN lines frequently contain useradd/adduser to create a non-root runtime user.
• Writing launchd plists or systemd units for a developer's own local service (a test daemon, a local queue worker, a scheduled backup job).
• Security-research or red-team lab work where the operator is intentionally building persistence artefacts for testing.

References

• https://attack.mitre.org/techniques/T1053/003/
• https://attack.mitre.org/techniques/T1053/004/
• https://attack.mitre.org/techniques/T1543/002/
• https://attack.mitre.org/techniques/T1546/004/
• https://attack.mitre.org/techniques/T1136/001/

Related threats