# Persistence Mechanism Installation

- **Severity:** High
- **Signature ID:** `d12c1b8c-4ee7-5548-947b-a1627bdc98dc`
- **MITRE ATLAS:** AML.T0053 (AI Agent Tool Invocation), AML.T0050 (Command and Scripting Interpreter)
- **OWASP:** ASI07 (Unsafe Autonomous Code Execution), LLM06 (Excessive Agency)

## Summary

This rule watches for an AI agent's command execution or file-editing tools being used to create mechanisms that run code automatically at startup or on a schedule. These mechanisms — cron jobs, launchd agents, systemd units, or shell profile edits — are a standard way attackers keep access to a system after their initial foothold.

## How the attack works

An attacker (or a compromised/manipulated agent) gains the ability to run shell commands or edit files. It then either runs a command that adds a cron entry, creates a launchd or systemd unit file, or edits a shell startup file such as .bashrc or .profile. It could also use a file-editing tool to write directly to one of these same locations. Once in place, the entry runs automatically on every login, reboot, or scheduled interval, giving the attacker a way back in without repeating the initial compromise. A companion rule looks for the same file writes at the EDR level for cases where the agent-level command isn't visible.

## Why it matters

An attacker who reaches this step no longer needs to re-exploit the original entry point; they get a standing foothold that survives reboots and session restarts, which extends dwell time and makes cleanup harder.

## What you can do

- Review new cron entries, launch agents, systemd units, and shell profile changes on hosts where AI agents have shell or file-editing access.
- Restrict which directories and files agent tools are allowed to write to, especially startup and scheduling locations.
- Alert on any agent-initiated changes to cron, launchd, systemd, or shell profile files rather than allowing silent writes.
- Maintain a baseline of expected scheduled tasks and startup entries so unexpected additions stand out.

## Known benign look-alikes

- Legitimate cron job setup for scheduled tasks
- System administrators configuring launch agents for authorised services
- Developers adding shell aliases and PATH entries to startup files

## References

- https://attack.mitre.org/techniques/T1053/
- https://attack.mitre.org/techniques/T1543/
- https://attack.mitre.org/techniques/T1546/

---
Source: https://www.netzilo.com/threats/persistence