Persistence: Disarm the Malicious Timer

MediumPersistence Hunting15 min

The brief

This attacker skipped cron and used a systemd TIMER for persistence: a .timer unit in /etc/systemd/system/ fires a paired .service every few minutes to re-establish a beacon. Find it and remove all of it — the .timer, the .service it starts, and the timer's enable symlink in timers.target.wants/ — leaving the box's other units alone.

ls -la /etc/systemd/system/*.timer /etc/systemd/system/timers.target.wants/ 2>/dev/null

Grading checks the malicious .timer, its .service, and the enable symlink are all gone.

What you'll do

Remove the malicious timer unit, its paired service, and the timer's enable symlink

Hands-on lab: you work on a real Linux box in your browser, graded on the machine's actual state.