back to labs
Persistence: Remove the Scheduled at Job
MediumPersistence Hunting15 minThe brief
The attacker queued a one-shot 'at' job to re-run their implant after the box is cleaned. Queued at jobs live as files in the atd spool (/var/spool/cron/atjobs/). Find the malicious job file and remove it, leaving the legitimate queued job in place.
ls -la /var/spool/cron/atjobs/
Grading checks the malicious job is gone and the legit one remains.
What you'll do
- Delete the malicious at-job spool file
- Leave the legitimate queued job intact
Hands-on lab: you work on a real Linux box in your browser, graded on the machine's actual state.