{"id":22152,"date":"2026-09-26T11:41:07","date_gmt":"2026-09-26T08:11:07","guid":{"rendered":"https:\/\/maralhost.com\/kb\/docs\/security\/%d8%a8%d8%b1%d8%b1%d8%b3%db%8c-persistence-%d8%af%d8%b1-%d9%84%db%8c%d9%86%d9%88%da%a9%d8%b3\/"},"modified":"2026-09-26T11:46:20","modified_gmt":"2026-09-26T08:16:20","slug":"linux-persistence","status":"publish","type":"docs","link":"https:\/\/maralhost.com\/kb\/docs\/security\/linux-persistence\/","title":{"rendered":"\u0628\u0631\u0631\u0633\u06cc Persistence \u062f\u0631 \u0644\u06cc\u0646\u0648\u06a9\u0633"},"content":{"rendered":"\n<h1 class=\"wp-block-heading\"> \u0634\u0646\u0627\u0633\u0627\u06cc\u06cc \u0631\u0648\u0634\u200c\u0647\u0627\u06cc \u0645\u0627\u0646\u062f\u06af\u0627\u0631\u06cc \u0645\u0647\u0627\u062c\u0645<\/h1>\n\n\n\n<h2 class=\"wp-block-heading\">\u0645\u0642\u062f\u0645\u0647<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">\u062f\u0631 \u0628\u0633\u06cc\u0627\u0631\u06cc \u0627\u0632 Incident\u0647\u0627\u06cc \u0627\u0645\u0646\u06cc\u062a\u06cc\u060c \u062f\u0633\u062a\u0631\u0633\u06cc \u0627\u0648\u0644\u06cc\u0647 \u0645\u0647\u0627\u062c\u0645 \u067e\u0627\u06cc\u0627\u0646 \u06a9\u0627\u0631 \u0646\u06cc\u0633\u062a.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u067e\u0633 \u0627\u0632 \u0646\u0641\u0648\u0630\u060c \u0645\u0647\u0627\u062c\u0645 \u0645\u0645\u06a9\u0646 \u0627\u0633\u062a \u062a\u0644\u0627\u0634 \u06a9\u0646\u062f \u0631\u0648\u0634\u06cc \u0627\u06cc\u062c\u0627\u062f \u06a9\u0646\u062f \u06a9\u0647 \u062d\u062a\u06cc \u0628\u0639\u062f \u0627\u0632:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Reboot \u0634\u062f\u0646 Server<\/li>\n\n\n\n<li>\u0628\u0633\u062a\u0647 \u0634\u062f\u0646 Session<\/li>\n\n\n\n<li>Terminate \u0634\u062f\u0646 Process<\/li>\n\n\n\n<li>\u062a\u063a\u06cc\u06cc\u0631 \u0628\u0639\u0636\u06cc \u062a\u0646\u0638\u06cc\u0645\u0627\u062a<\/li>\n\n\n\n<li>\u0642\u0637\u0639 \u0627\u062a\u0635\u0627\u0644 \u0627\u0648\u0644\u06cc\u0647<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">\u062f\u0648\u0628\u0627\u0631\u0647 \u0628\u062a\u0648\u0627\u0646\u062f \u06a9\u062f \u062e\u0648\u062f \u0631\u0627 \u0627\u062c\u0631\u0627 \u06a9\u0646\u062f \u06cc\u0627 \u0628\u0647 \u0633\u06cc\u0633\u062a\u0645 \u062f\u0633\u062a\u0631\u0633\u06cc \u062f\u0627\u0634\u062a\u0647 \u0628\u0627\u0634\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0647 \u0627\u06cc\u0646 \u062a\u06a9\u0646\u06cc\u06a9\u200c\u0647\u0627:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Persistence<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u06cc\u0627 \u0645\u0627\u0646\u062f\u06af\u0627\u0631\u06cc \u062f\u0631 \u0633\u06cc\u0633\u062a\u0645 \u06af\u0641\u062a\u0647 \u0645\u06cc\u200c\u0634\u0648\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u062f\u0631 Linux \u0631\u0648\u0634\u200c\u0647\u0627\u06cc \u0645\u062e\u062a\u0644\u0641\u06cc \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u0646\u062f \u0628\u0631\u0627\u06cc Persistence \u0645\u0648\u0631\u062f \u0633\u0648\u0621\u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0642\u0631\u0627\u0631 \u0628\u06af\u06cc\u0631\u0646\u062f\u061b \u0627\u0632 \u062c\u0645\u0644\u0647:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Cron Jobs\nsystemd Services\nsystemd Timers\nSSH Authorized Keys\nUser Accounts\nsudoers\nShell Startup Files\nrc.local\nStartup Scripts\nat Jobs<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">MITRE ATT&amp;CK \u0646\u06cc\u0632 Cron\u060c systemd Timer\u060c systemd Service \u0648 SSH Authorized Keys \u0631\u0627 \u062f\u0631 \u0645\u06cc\u0627\u0646 \u062a\u06a9\u0646\u06cc\u06a9\u200c\u0647\u0627\u06cc\u06cc \u0642\u0631\u0627\u0631 \u0645\u06cc\u200c\u062f\u0647\u062f \u06a9\u0647 \u0645\u0645\u06a9\u0646 \u0627\u0633\u062a \u0628\u0631\u0627\u06cc Persistence \u0645\u0648\u0631\u062f \u0633\u0648\u0621\u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0642\u0631\u0627\u0631 \u06af\u06cc\u0631\u0646\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u062f\u0631 \u0627\u06cc\u0646 \u0645\u0642\u0627\u0644\u0647 \u0631\u0648\u0634 \u0628\u0631\u0631\u0633\u06cc \u0627\u06cc\u0646 \u0646\u0642\u0627\u0637 \u062f\u0631 Linux Server \u0631\u0627 \u0628\u0647\u200c\u0635\u0648\u0631\u062a \u0639\u0645\u0644\u06cc \u0628\u0631\u0631\u0633\u06cc \u0645\u06cc\u200c\u06a9\u0646\u06cc\u0645.<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p class=\"wp-block-paragraph\">\u0647\u062f\u0641 \u0627\u06cc\u0646 \u0645\u0642\u0627\u0644\u0647 Detection \u0648 Incident Response \u0631\u0648\u06cc \u0633\u0631\u0648\u0631\u0647\u0627\u06cc \u062a\u062d\u062a \u0645\u062f\u06cc\u0631\u06cc\u062a \u0634\u0645\u0627 \u0627\u0633\u062a\u061b \u0646\u0647 \u0627\u06cc\u062c\u0627\u062f Persistence.<\/p>\n<\/blockquote>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Persistence \u0686\u06cc\u0633\u062a\u061f<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0641\u0631\u0636 \u06a9\u0646\u06cc\u062f \u0645\u0647\u0627\u062c\u0645 \u0627\u0632 \u0637\u0631\u06cc\u0642 \u06cc\u06a9 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc Web Application \u0648\u0627\u0631\u062f Server \u0634\u062f\u0647 \u0627\u0633\u062a.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u062f\u0633\u062a\u0631\u0633\u06cc \u0627\u0648\u0644\u06cc\u0647 \u0645\u0645\u06a9\u0646 \u0627\u0633\u062a \u0645\u0648\u0642\u062a \u0628\u0627\u0634\u062f:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Vulnerable Application\n        |\n        v\nTemporary Access<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u06af\u0631 Server Restart \u0634\u0648\u062f \u06cc\u0627 Vulnerability \u0628\u0631\u0637\u0631\u0641 \u0634\u0648\u062f\u060c \u0645\u0647\u0627\u062c\u0645 \u0645\u0645\u06a9\u0646 \u0627\u0633\u062a \u062f\u0633\u062a\u0631\u0633\u06cc \u062e\u0648\u062f \u0631\u0627 \u0627\u0632 \u062f\u0633\u062a \u0628\u062f\u0647\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0646\u0627\u0628\u0631\u0627\u06cc\u0646 \u0645\u0645\u06a9\u0646 \u0627\u0633\u062a \u062a\u0644\u0627\u0634 \u06a9\u0646\u062f \u06cc\u06a9 Mechanism \u062f\u06cc\u06af\u0631\u06cc \u0627\u06cc\u062c\u0627\u062f \u06a9\u0646\u062f:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Initial Access\n      |\n      v\nPersistence Mechanism\n      |\n      v\nAccess After Reboot<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u0645\u062b\u0627\u0644 \u0645\u0645\u06a9\u0646 \u0627\u0633\u062a \u06cc\u06a9 Scheduled Job\u060c Service \u06cc\u0627 SSH Key \u0646\u0627\u0634\u0646\u0627\u0633 \u0631\u0648\u06cc \u0633\u06cc\u0633\u062a\u0645 \u0628\u0627\u0642\u06cc \u0628\u0645\u0627\u0646\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0622\u06cc\u0627 \u0647\u0631 Persistence Mechanism \u0645\u062e\u0631\u0628 \u0627\u0633\u062a\u061f<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u062e\u06cc\u0631.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0633\u06cc\u0627\u0631\u06cc \u0627\u0632 \u0647\u0645\u06cc\u0646 \u0645\u06a9\u0627\u0646\u06cc\u0632\u0645\u200c\u0647\u0627 \u06a9\u0627\u0645\u0644\u0627\u064b \u0642\u0627\u0646\u0648\u0646\u06cc \u0647\u0633\u062a\u0646\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u0645\u062b\u0627\u0644:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Cron\nsystemd\nSSH Keys\nStartup Scripts<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u062e\u0634 \u0637\u0628\u06cc\u0639\u06cc \u0645\u062f\u06cc\u0631\u06cc\u062a Linux \u0647\u0633\u062a\u0646\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0645\u0633\u0626\u0644\u0647 \u0627\u0635\u0644\u06cc \u0627\u06cc\u0646 \u0627\u0633\u062a:<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p class=\"wp-block-paragraph\">\u0622\u06cc\u0627 \u0627\u06cc\u0646 \u0645\u0648\u0631\u062f \u0628\u0627\u06cc\u062f \u0631\u0648\u06cc Server \u0648\u062c\u0648\u062f \u062f\u0627\u0634\u062a\u0647 \u0628\u0627\u0634\u062f\u061f<\/p>\n<\/blockquote>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0646\u0627\u0628\u0631\u0627\u06cc\u0646 Detection \u0628\u0627\u06cc\u062f \u0628\u0631\u0627\u0633\u0627\u0633:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Baseline\nOwner\nPurpose\nFile Path\nModification Time\nExecution Command\nUser\nLogs<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u0646\u062c\u0627\u0645 \u0634\u0648\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0642\u0628\u0644 \u0627\u0632 \u0647\u0631 \u06a9\u0627\u0631\u06cc Evidence \u0631\u0627 \u062d\u0641\u0638 \u06a9\u0646\u06cc\u062f<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u06af\u0631 \u0627\u062d\u062a\u0645\u0627\u0644 Incident \u0648\u0627\u0642\u0639\u06cc \u0648\u062c\u0648\u062f \u062f\u0627\u0631\u062f\u060c \u0628\u0644\u0627\u0641\u0627\u0635\u0644\u0647 \u0641\u0627\u06cc\u0644 \u0645\u0634\u06a9\u0648\u06a9 \u0631\u0627 \u062d\u0630\u0641 \u0646\u06a9\u0646\u06cc\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u0628\u062a\u062f\u0627 \u0627\u0637\u0644\u0627\u0639\u0627\u062a\u06cc \u0645\u0627\u0646\u0646\u062f:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Path\nOwner\nPermissions\nTimestamp\nHash\nContent<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0631\u0627 \u062b\u0628\u062a \u06a9\u0646\u06cc\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u0645\u062b\u0627\u0644:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>stat \/path\/to\/suspicious-file<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0648:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sha256sum \/path\/to\/suspicious-file<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u06af\u0631 \u0641\u0627\u06cc\u0644 \u0645\u062a\u0646\u06cc \u0627\u0633\u062a:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>cat \/path\/to\/suspicious-file<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u06cc\u0627:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>less \/path\/to\/suspicious-file<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0633\u067e\u0633 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646 \u0646\u0633\u062e\u0647\u200c\u0627\u06cc \u0627\u0632 Evidence \u062a\u0647\u06cc\u0647 \u06a9\u0631\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0645\u0631\u062d\u0644\u0647 \u0627\u0648\u0644: \u0628\u0631\u0631\u0633\u06cc Cron Jobs<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">Cron \u06cc\u06a9\u06cc \u0627\u0632 \u0627\u0648\u0644\u06cc\u0646 \u0645\u06a9\u0627\u0646\u200c\u0647\u0627\u06cc\u06cc \u0627\u0633\u062a \u06a9\u0647 \u0647\u0646\u06af\u0627\u0645 \u0628\u0631\u0631\u0633\u06cc Persistence \u0628\u0627\u06cc\u062f \u06a9\u0646\u062a\u0631\u0644 \u0634\u0648\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0647\u0631 User \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f Crontab \u0645\u062e\u0635\u0648\u0635 \u062e\u0648\u062f \u062f\u0627\u0634\u062a\u0647 \u0628\u0627\u0634\u062f \u0648 Command\u0647\u0627\u06cc \u0645\u0648\u062c\u0648\u062f \u062f\u0631 Crontab \u062a\u062d\u062a \u0647\u0645\u0627\u0646 User \u0627\u062c\u0631\u0627 \u0645\u06cc\u200c\u0634\u0648\u0646\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u0645\u0634\u0627\u0647\u062f\u0647 Cron \u0645\u0631\u0628\u0648\u0637 \u0628\u0647 User \u0641\u0639\u0644\u06cc:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>crontab -l<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc Root:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo crontab -l<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Cron \u062a\u0645\u0627\u0645 \u06a9\u0627\u0631\u0628\u0631\u0627\u0646 \u0631\u0627 \u0628\u0631\u0631\u0633\u06cc \u06a9\u0646\u06cc\u0645<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u0628\u062a\u062f\u0627 User\u0647\u0627\u06cc \u0633\u06cc\u0633\u062a\u0645 \u0631\u0627 \u0645\u0634\u0627\u0647\u062f\u0647 \u06a9\u0646\u06cc\u062f:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>cut -d: -f1 \/etc\/passwd<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0633\u067e\u0633 \u0628\u0647\u200c\u0639\u0646\u0648\u0627\u0646 Root \u0645\u06cc\u200c\u062a\u0648\u0627\u0646 Crontab \u06a9\u0627\u0631\u0628\u0631\u0627\u0646 \u0631\u0627 \u0628\u0631\u0631\u0633\u06cc \u06a9\u0631\u062f:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>for user in $(cut -f1 -d: \/etc\/passwd); do\n    echo \"===== $user =====\"\n    crontab -u \"$user\" -l 2&gt;\/dev\/null\ndone<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u062f\u0631 Server Production \u0628\u0627\u06cc\u062f Cron Job\u0647\u0627\u06cc \u0641\u0639\u0627\u0644 Owner \u0648 Purpose \u0645\u0634\u062e\u0635 \u062f\u0627\u0634\u062a\u0647 \u0628\u0627\u0634\u0646\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0645\u0633\u06cc\u0631\u0647\u0627\u06cc \u0645\u0647\u0645 Cron<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0641\u0642\u0637 <code>crontab -l<\/code> \u06a9\u0627\u0641\u06cc \u0646\u06cc\u0633\u062a.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0645\u0633\u06cc\u0631\u0647\u0627\u06cc System Cron \u0646\u06cc\u0632 \u0628\u0627\u06cc\u062f \u0628\u0631\u0631\u0633\u06cc \u0634\u0648\u0646\u062f:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>\/etc\/crontab\n\/etc\/cron.d\/\n\/etc\/cron.hourly\/\n\/etc\/cron.daily\/\n\/etc\/cron.weekly\/\n\/etc\/cron.monthly\/<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0645\u0634\u0627\u0647\u062f\u0647:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>cat \/etc\/crontab<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0648:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>ls -lah \/etc\/cron.d\/<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0647\u0645\u0686\u0646\u06cc\u0646:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>ls -lah \/etc\/cron.hourly\/\nls -lah \/etc\/cron.daily\/\nls -lah \/etc\/cron.weekly\/\nls -lah \/etc\/cron.monthly\/<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Cron Spool \u0631\u0627 \u0628\u0631\u0631\u0633\u06cc \u06a9\u0646\u06cc\u0645<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0645\u062d\u0644 Crontab\u0647\u0627\u06cc \u06a9\u0627\u0631\u0628\u0631\u0627\u0646 \u0628\u0633\u062a\u0647 \u0628\u0647 Distribution \u0645\u062a\u0641\u0627\u0648\u062a \u0627\u0633\u062a.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0645\u0645\u06a9\u0646 \u0627\u0633\u062a \u0645\u0633\u06cc\u0631\u0647\u0627\u06cc\u06cc \u0645\u0627\u0646\u0646\u062f:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>\/var\/spool\/cron\/\n\/var\/spool\/cron\/crontabs\/<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0648\u062c\u0648\u062f \u062f\u0627\u0634\u062a\u0647 \u0628\u0627\u0634\u0646\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0631\u0633\u06cc:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>ls -lah \/var\/spool\/cron 2&gt;\/dev\/null<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0648:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>ls -lah \/var\/spool\/cron\/crontabs 2&gt;\/dev\/null<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0641\u0627\u06cc\u0644\u200c\u0647\u0627\u06cc \u0627\u06cc\u0646 \u0628\u062e\u0634 \u0645\u0639\u0645\u0648\u0644\u0627\u064b \u0646\u0628\u0627\u06cc\u062f \u0645\u0633\u062a\u0642\u06cc\u0645\u0627\u064b Edit \u0634\u0648\u0646\u062f\u060c \u0627\u0645\u0627 \u0628\u0631\u0627\u06cc Investigation \u0645\u06cc\u200c\u062a\u0648\u0627\u0646 \u0622\u0646\u0647\u0627 \u0631\u0627 \u0628\u0647\u200c\u0635\u0648\u0631\u062a Read-only \u0628\u0631\u0631\u0633\u06cc \u06a9\u0631\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">@reboot \u0631\u0627 \u0641\u0631\u0627\u0645\u0648\u0634 \u0646\u06a9\u0646\u06cc\u062f<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">Cron \u0642\u0627\u0628\u0644\u06cc\u062a:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>@reboot<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u062f\u0627\u0631\u062f \u06a9\u0647 Command \u0631\u0627 \u067e\u0633 \u0627\u0632 Boot \u0627\u062c\u0631\u0627 \u0645\u06cc\u200c\u06a9\u0646\u062f. \u0627\u06cc\u0646 \u0642\u0627\u0628\u0644\u06cc\u062a \u062f\u0631 Crontab \u0645\u0633\u062a\u0646\u062f \u0634\u062f\u0647 \u0627\u0633\u062a.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u067e\u06cc\u062f\u0627 \u06a9\u0631\u062f\u0646 \u0622\u0646:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>grep -RIn \"@reboot\" \/etc\/cron* \/var\/spool\/cron* 2&gt;\/dev\/null<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0648\u062c\u0648\u062f <code>@reboot<\/code> \u0644\u0632\u0648\u0645\u0627\u064b \u0645\u062e\u0631\u0628 \u0646\u06cc\u0633\u062a.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u0645\u0627 Command \u0645\u0631\u0628\u0648\u0637 \u0628\u0647 \u0622\u0646 \u0628\u0627\u06cc\u062f \u0628\u0631\u0631\u0633\u06cc \u0634\u0648\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u062f\u0631 Cron \u062f\u0646\u0628\u0627\u0644 \u0686\u0647 \u0686\u06cc\u0632\u0647\u0627\u06cc\u06cc \u0628\u06af\u0631\u062f\u06cc\u0645\u061f<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0645\u0648\u0627\u0631\u062f\u06cc \u06a9\u0647 \u0628\u06cc\u0634\u062a\u0631 \u0646\u06cc\u0627\u0632\u0645\u0646\u062f \u0628\u0631\u0631\u0633\u06cc \u0647\u0633\u062a\u0646\u062f:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Job \u0646\u0627\u0634\u0646\u0627\u0633<\/li>\n\n\n\n<li>Script \u062f\u0631 <code>\/tmp<\/code><\/li>\n\n\n\n<li>Script \u062f\u0631 <code>\/dev\/shm<\/code><\/li>\n\n\n\n<li>Executable \u062f\u0627\u062e\u0644 Home Directory \u063a\u06cc\u0631\u0645\u0646\u062a\u0638\u0631\u0647<\/li>\n\n\n\n<li>Command\u06cc \u06a9\u0647 Network Connection \u0627\u06cc\u062c\u0627\u062f \u0645\u06cc\u200c\u06a9\u0646\u062f<\/li>\n\n\n\n<li>File Name \u0634\u0628\u06cc\u0647 System Component<\/li>\n\n\n\n<li>Job \u0645\u062a\u0639\u0644\u0642 \u0628\u0647 User \u063a\u06cc\u0631\u0645\u0646\u062a\u0638\u0631\u0647<\/li>\n\n\n\n<li>Job \u062a\u0627\u0632\u0647 \u0627\u06cc\u062c\u0627\u062f\u0634\u062f\u0647<\/li>\n\n\n\n<li>Job \u0628\u062f\u0648\u0646 Documentation<\/li>\n\n\n\n<li>\u0627\u062c\u0631\u0627\u06cc Script \u0628\u0627 Root<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0632\u0645\u0627\u0646 \u062a\u063a\u06cc\u06cc\u0631 Cron File\u0647\u0627 \u0631\u0627 \u0628\u0631\u0631\u0633\u06cc \u06a9\u0646\u06cc\u0645<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u0645\u062b\u0627\u0644:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>find \/etc\/cron.d \/etc\/cron.daily \/etc\/cron.hourly \\\n-type f -printf '%TY-%Tm-%Td %TH:%TM %u %g %p\\n' 2&gt;\/dev\/null | sort<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u06cc\u0627 \u0628\u0631\u0627\u06cc \u0641\u0627\u06cc\u0644 \u062e\u0627\u0635:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>stat \/etc\/cron.d\/example<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Timestamp \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u0628\u0631\u0627\u06cc \u0633\u0627\u062e\u062a Timeline \u0645\u0641\u06cc\u062f \u0628\u0627\u0634\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0645\u0631\u062d\u0644\u0647 \u062f\u0648\u0645: \u0628\u0631\u0631\u0633\u06cc systemd Service\u0647\u0627<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0631\u0648\u06cc Distribution\u0647\u0627\u06cc \u062c\u062f\u06cc\u062f Linux\u060c systemd \u06cc\u06a9\u06cc \u0627\u0632 \u0645\u0647\u0645\u200c\u062a\u0631\u06cc\u0646 \u0646\u0642\u0627\u0637 Persistence \u0627\u0633\u062a.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Service Unit \u0641\u0627\u06cc\u0644\u200c\u0647\u0627\u06cc\u06cc \u0628\u0627 \u067e\u0633\u0648\u0646\u062f:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>.service<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0647\u0633\u062a\u0646\u062f \u06a9\u0647 Process\u0647\u0627 \u0631\u0627 \u062a\u062d\u062a \u06a9\u0646\u062a\u0631\u0644 systemd \u0627\u062c\u0631\u0627 \u0645\u06cc\u200c\u06a9\u0646\u0646\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u0628\u062a\u062f\u0627 Service\u0647\u0627\u06cc \u062f\u0631 \u062d\u0627\u0644 \u0627\u062c\u0631\u0627 \u0631\u0627 \u0628\u0628\u06cc\u0646\u06cc\u062f:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>systemctl list-units --type=service --state=running<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Service\u0647\u0627\u06cc Enabled \u0631\u0627 \u0628\u0631\u0631\u0633\u06cc \u06a9\u0646\u06cc\u0645<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u0645\u0634\u0627\u0647\u062f\u0647 Service\u0647\u0627\u06cc\u06cc \u06a9\u0647 \u0628\u0631\u0627\u06cc Startup \u062a\u0646\u0638\u06cc\u0645 \u0634\u062f\u0647\u200c\u0627\u0646\u062f:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>systemctl list-unit-files --type=service --state=enabled<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0647\u0631 Service \u0646\u0627\u0634\u0646\u0627\u062e\u062a\u0647\u200c\u0627\u06cc \u0631\u0627 \u0628\u0631\u0631\u0633\u06cc \u06a9\u0646\u06cc\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0647 \u0646\u0627\u0645 Service \u0627\u0639\u062a\u0645\u0627\u062f \u0646\u06a9\u0646\u06cc\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u0645\u062b\u0627\u0644 \u0646\u0627\u0645\u06cc \u0645\u0627\u0646\u0646\u062f:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>system-update.service\nnetwork-helper.service\nsecurity-agent.service<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0645\u0645\u06a9\u0646 \u0627\u0633\u062a \u0642\u0627\u0646\u0648\u0646\u06cc \u06cc\u0627 \u0646\u0627\u0634\u0646\u0627\u0633 \u0628\u0627\u0634\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0645\u0633\u06cc\u0631 \u0648\u0627\u0642\u0639\u06cc Executable \u0627\u0647\u0645\u06cc\u062a \u0628\u06cc\u0634\u062a\u0631\u06cc \u062f\u0627\u0631\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0645\u062d\u0644 Unit File \u0631\u0627 \u067e\u06cc\u062f\u0627 \u06a9\u0646\u06cc\u0645<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u06cc\u06a9 Service:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>systemctl status example.service<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0633\u067e\u0633:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>systemctl show example.service -p FragmentPath<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0645\u062b\u0644\u0627\u064b:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>FragmentPath=\/etc\/systemd\/system\/example.service<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">systemd Unit\u0647\u0627 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u0646\u062f \u0627\u0632 \u0686\u0646\u062f \u0645\u0633\u06cc\u0631 Load \u0634\u0648\u0646\u062f\u061b \u0627\u0632 \u062c\u0645\u0644\u0647 <code>\/etc\/systemd\/system\/<\/code>\u060c <code>\/run\/systemd\/system\/<\/code> \u0648 \u0645\u0633\u06cc\u0631\u0647\u0627\u06cc System Unit \u0645\u0631\u0628\u0648\u0637 \u0628\u0647 Distribution.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0645\u062d\u062a\u0648\u0627\u06cc Service \u0631\u0627 \u0628\u0631\u0631\u0633\u06cc \u06a9\u0646\u06cc\u0645<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0631\u0648\u0634 \u0645\u0646\u0627\u0633\u0628:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>systemctl cat example.service<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0647\u200c\u062e\u0635\u0648\u0635 \u0628\u062e\u0634\u200c\u0647\u0627\u06cc\u06cc \u0645\u0627\u0646\u0646\u062f:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>ExecStart=\nUser=\nWorkingDirectory=\nEnvironment=<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0631\u0627 \u0628\u0631\u0631\u0633\u06cc \u06a9\u0646\u06cc\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u0645\u0634\u0627\u0647\u062f\u0647 \u0628\u0639\u0636\u06cc Property\u0647\u0627\u06cc \u0645\u0647\u0645:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>systemctl show example.service \\\n-p FragmentPath \\\n-p User \\\n-p ExecStart<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0686\u0647 systemd Service\u0647\u0627\u06cc\u06cc \u0645\u0634\u06a9\u0648\u06a9\u200c\u062a\u0631 \u0647\u0633\u062a\u0646\u062f\u061f<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0645\u0648\u0627\u0631\u062f \u0632\u06cc\u0631 \u0627\u0631\u0632\u0634 \u0628\u0631\u0631\u0633\u06cc \u0628\u06cc\u0634\u062a\u0631\u06cc \u062f\u0627\u0631\u0646\u062f:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Service \u0646\u0627\u0634\u0646\u0627\u0633\n+\nEnabled\n+\nRun as root\n+\nExecutable \u063a\u06cc\u0631\u0645\u0639\u0645\u0648\u0644<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u06cc\u0627:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>ExecStart=\/tmp\/...<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u06cc\u0627:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>ExecStart=\/dev\/shm\/...<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u06cc\u0627:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>ExecStart=\/home\/...\/.hidden\/...<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0647\u0645\u0686\u0646\u06cc\u0646 Unit\u0647\u0627\u06cc \u062c\u062f\u06cc\u062f \u062f\u0627\u062e\u0644:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>\/etc\/systemd\/system\/<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0627\u06cc\u062f \u0628\u0627 Change History \u0633\u0631\u0648\u0631 \u0645\u0642\u0627\u06cc\u0633\u0647 \u0634\u0648\u0646\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Service\u0647\u0627\u06cc \u062c\u062f\u06cc\u062f \u0631\u0627 \u067e\u06cc\u062f\u0627 \u06a9\u0646\u06cc\u0645<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u0645\u0634\u0627\u0647\u062f\u0647 \u0641\u0627\u06cc\u0644\u200c\u0647\u0627\u06cc \u062a\u063a\u06cc\u06cc\u0631\u06a9\u0631\u062f\u0647 \u062f\u0631 \u0647\u0641\u062a \u0631\u0648\u0632 \u0627\u062e\u06cc\u0631:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>find \/etc\/systemd\/system \\\n-type f -mtime -7 -ls 2&gt;\/dev\/null<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u062c\u0632\u0626\u06cc\u0627\u062a \u0641\u0627\u06cc\u0644:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>stat \/etc\/systemd\/system\/example.service<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0648 Hash:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sha256sum \/etc\/systemd\/system\/example.service<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Symlink\u0647\u0627\u06cc systemd \u0631\u0627 \u0628\u0631\u0631\u0633\u06cc \u06a9\u0646\u06cc\u0645<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0641\u0639\u0627\u0644 \u0634\u062f\u0646 \u06cc\u06a9 Service \u0645\u0639\u0645\u0648\u0644\u0627\u064b \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u0628\u0627 Symlink\u0647\u0627\u06cc\u06cc \u062f\u0631 Target Directory\u0647\u0627 \u0647\u0645\u0631\u0627\u0647 \u0628\u0627\u0634\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0645\u0634\u0627\u0647\u062f\u0647:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>find \/etc\/systemd\/system -type l -ls<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0647\u0645\u0686\u0646\u06cc\u0646:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>systemctl is-enabled example.service<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0645\u0634\u062e\u0635 \u0645\u06cc\u200c\u06a9\u0646\u062f Unit \u0645\u0648\u0631\u062f\u0646\u0638\u0631 Enabled \u0627\u0633\u062a \u06cc\u0627 \u062e\u06cc\u0631.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Log \u06cc\u06a9 Service \u0631\u0627 \u0628\u0631\u0631\u0633\u06cc \u06a9\u0646\u06cc\u0645<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u0645\u0634\u0627\u0647\u062f\u0647 Log:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>journalctl -u example.service<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc 24 \u0633\u0627\u0639\u062a \u0627\u062e\u06cc\u0631:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>journalctl -u example.service --since \"24 hours ago\"<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><code>journalctl<\/code> \u0627\u0628\u0632\u0627\u0631 \u0627\u0633\u062a\u0627\u0646\u062f\u0627\u0631\u062f \u0646\u0645\u0627\u06cc\u0634 Log\u0647\u0627\u06cc \u0630\u062e\u06cc\u0631\u0647\u200c\u0634\u062f\u0647 \u062a\u0648\u0633\u0637 systemd journal \u0627\u0633\u062a.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0645\u0631\u062d\u0644\u0647 \u0633\u0648\u0645: \u0628\u0631\u0631\u0633\u06cc systemd Timer\u0647\u0627<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">systemd Timer\u0647\u0627 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u0646\u062f \u0645\u0634\u0627\u0628\u0647 Cron \u0628\u0631\u0627\u06cc \u0627\u062c\u0631\u0627\u06cc Task\u0647\u0627\u06cc \u0632\u0645\u0627\u0646\u200c\u0628\u0646\u062f\u06cc\u200c\u0634\u062f\u0647 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0634\u0648\u0646\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Timer Unit\u0647\u0627 \u067e\u0633\u0648\u0646\u062f:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>.timer<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u062f\u0627\u0631\u0646\u062f \u0648 \u0628\u0631\u0627\u06cc \u0641\u0639\u0627\u0644\u200c\u0633\u0627\u0632\u06cc Unit \u062f\u06cc\u06af\u0631\u06cc \u062f\u0631 \u0632\u0645\u0627\u0646 \u0645\u0634\u062e\u0635 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0645\u06cc\u200c\u0634\u0648\u0646\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u0645\u0634\u0627\u0647\u062f\u0647 Timer\u0647\u0627:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>systemctl list-timers --all<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Timer\u0647\u0627\u06cc Enabled \u0631\u0627 \u0628\u0631\u0631\u0633\u06cc \u06a9\u0646\u06cc\u0645<\/h1>\n\n\n\n<pre class=\"wp-block-code\"><code>systemctl list-unit-files --type=timer --state=enabled<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u0647\u0631 Timer \u0646\u0627\u0634\u0646\u0627\u0633:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>systemctl status example.timer<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0648:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>systemctl cat example.timer<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0633\u067e\u0633 Service \u0645\u0631\u062a\u0628\u0637 \u0631\u0627 \u0646\u06cc\u0632 \u0628\u0631\u0631\u0633\u06cc \u06a9\u0646\u06cc\u062f:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>systemctl cat example.service<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Timer\u0647\u0627\u06cc User-level \u0631\u0627 \u0641\u0631\u0627\u0645\u0648\u0634 \u0646\u06a9\u0646\u06cc\u062f<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">systemd \u0641\u0642\u0637 Service\u0647\u0627\u06cc System-wide \u0646\u062f\u0627\u0631\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">User\u0647\u0627 \u0646\u06cc\u0632 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u0646\u062f Unit\u0647\u0627\u06cc \u062e\u0648\u062f \u0631\u0627 \u062f\u0627\u0634\u062a\u0647 \u0628\u0627\u0634\u0646\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u06cc\u06a9\u06cc \u0627\u0632 \u0645\u0633\u06cc\u0631\u0647\u0627\u06cc \u0645\u0647\u0645:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>~\/.config\/systemd\/user\/<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u0633\u062a. \u0645\u0633\u06cc\u0631\u0647\u0627\u06cc User Unit \u0646\u06cc\u0632 \u062f\u0631 \u0645\u0633\u062a\u0646\u062f\u0627\u062a systemd \u062a\u0639\u0631\u06cc\u0641 \u0634\u062f\u0647\u200c\u0627\u0646\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0631\u0633\u06cc:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>find \/root \/home \\\n-path '*\/.config\/systemd\/user\/*' \\\n-type f \\\n-print 2&gt;\/dev\/null<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc User \u0641\u0639\u0644\u06cc:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>systemctl --user list-timers --all<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0648:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>systemctl --user list-unit-files<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0645\u0631\u062d\u0644\u0647 \u0686\u0647\u0627\u0631\u0645: \u0628\u0631\u0631\u0633\u06cc SSH Authorized Keys<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u06cc\u06a9\u06cc \u062f\u06cc\u06af\u0631 \u0627\u0632 \u0646\u0642\u0627\u0637 \u0645\u0647\u0645 Persistence:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>authorized_keys<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u0633\u062a.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0647\u200c\u0635\u0648\u0631\u062a \u067e\u06cc\u0634\u200c\u0641\u0631\u0636 SSH \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f Public Key\u0647\u0627\u06cc \u0645\u062c\u0627\u0632 \u06cc\u06a9 User \u0631\u0627 \u0627\u0632:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>~\/.ssh\/authorized_keys<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u062e\u0648\u0627\u0646\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">MITRE ATT&amp;CK \u0646\u06cc\u0632 \u062a\u063a\u06cc\u06cc\u0631 SSH Authorized Keys \u0631\u0627 \u0628\u0647\u200c\u0639\u0646\u0648\u0627\u0646 \u06cc\u06a9\u06cc \u0627\u0632 \u062a\u06a9\u0646\u06cc\u06a9\u200c\u0647\u0627\u06cc Account Manipulation \u0628\u0631\u0627\u06cc Persistence \u062b\u0628\u062a \u06a9\u0631\u062f\u0647 \u0627\u0633\u062a.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">SSH Key\u0647\u0627\u06cc Root \u0631\u0627 \u0628\u0631\u0631\u0633\u06cc \u06a9\u0646\u06cc\u0645<\/h1>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo cat \/root\/.ssh\/authorized_keys 2&gt;\/dev\/null<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u0628\u0631\u0631\u0633\u06cc Metadata:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo stat \/root\/.ssh\/authorized_keys<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0647\u0645\u0686\u0646\u06cc\u0646:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo ls -lah \/root\/.ssh\/<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">SSH Key\u0647\u0627\u06cc \u062a\u0645\u0627\u0645 \u06a9\u0627\u0631\u0628\u0631\u0627\u0646 \u0631\u0627 \u067e\u06cc\u062f\u0627 \u06a9\u0646\u06cc\u0645<\/h1>\n\n\n\n<pre class=\"wp-block-code\"><code>find \/root \/home \\\n-path '*\/.ssh\/authorized_keys' \\\n-type f \\\n-print 2&gt;\/dev\/null<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u0646\u0645\u0627\u06cc\u0634 Metadata:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>find \/root \/home \\\n-path '*\/.ssh\/authorized_keys' \\\n-type f \\\n-exec stat {} \\; 2&gt;\/dev\/null<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Fingerprint \u06a9\u0644\u06cc\u062f\u0647\u0627 \u0631\u0627 \u0628\u0631\u0631\u0633\u06cc \u06a9\u0646\u06cc\u0645<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u0645\u062b\u0627\u0644:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>ssh-keygen -lf \/root\/.ssh\/authorized_keys<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u06cc\u0646 \u062e\u0631\u0648\u062c\u06cc \u0628\u0647 \u0645\u0642\u0627\u06cc\u0633\u0647 Key\u0647\u0627 \u0628\u0627 Inventory \u0633\u0627\u0632\u0645\u0627\u0646 \u06a9\u0645\u06a9 \u0645\u06cc\u200c\u06a9\u0646\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0647\u0631 SSH Key \u0645\u062f\u06cc\u0631\u06cc\u062a\u06cc \u0628\u0647\u062a\u0631 \u0627\u0633\u062a Owner \u0645\u0634\u062e\u0635 \u062f\u0627\u0634\u062a\u0647 \u0628\u0627\u0634\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0641\u0642\u0637 authorized_keys \u0631\u0627 \u0628\u0631\u0631\u0633\u06cc \u0646\u06a9\u0646\u06cc\u062f<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">Configuration \u0648\u0627\u0642\u0639\u06cc sshd \u0631\u0627 \u0646\u06cc\u0632 \u0628\u0631\u0631\u0633\u06cc \u06a9\u0646\u06cc\u062f:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sshd -T | grep -i authorizedkeys<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0645\u0648\u0627\u0631\u062f\u06cc \u0645\u0627\u0646\u0646\u062f:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>authorizedkeysfile\nauthorizedkeyscommand<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u0647\u0645\u06cc\u062a \u062f\u0627\u0631\u0646\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">OpenSSH \u0639\u0644\u0627\u0648\u0647 \u0628\u0631 <code>AuthorizedKeysFile<\/code> \u0627\u0632 \u0642\u0627\u0628\u0644\u06cc\u062a <code>AuthorizedKeysCommand<\/code> \u0646\u06cc\u0632 \u067e\u0634\u062a\u06cc\u0628\u0627\u0646\u06cc \u0645\u06cc\u200c\u06a9\u0646\u062f \u06a9\u0647 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u0628\u0631\u0627\u06cc \u062f\u0631\u06cc\u0627\u0641\u062a Key\u0647\u0627\u06cc \u0645\u062c\u0627\u0632 \u0627\u0632 \u06cc\u06a9 Program \u062e\u0627\u0631\u062c\u06cc \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0634\u0648\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u06af\u0631 Configuration \u063a\u06cc\u0631\u0645\u0639\u0645\u0648\u0644 \u0645\u0634\u0627\u0647\u062f\u0647 \u0634\u062f \u0628\u0627\u06cc\u062f \u062f\u0644\u06cc\u0644 \u0622\u0646 \u0645\u0634\u062e\u0635 \u0634\u0648\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0645\u0631\u062d\u0644\u0647 \u067e\u0646\u062c\u0645: \u0628\u0631\u0631\u0633\u06cc User\u0647\u0627\u06cc \u0645\u0634\u06a9\u0648\u06a9<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">Persistence \u0645\u0645\u06a9\u0646 \u0627\u0633\u062a \u0627\u0632 \u0637\u0631\u06cc\u0642 \u06cc\u06a9 User Account \u062c\u062f\u06cc\u062f \u0627\u0646\u062c\u0627\u0645 \u0634\u0648\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u062a\u0645\u0627\u0645 Account\u0647\u0627:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>getent passwd<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u062e\u0631\u0648\u062c\u06cc \u0633\u0627\u062f\u0647\u200c\u062a\u0631:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>cut -d: -f1,3,6,7 \/etc\/passwd<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">User\u0647\u0627\u06cc \u062f\u0627\u0631\u0627\u06cc Shell \u0631\u0627 \u0628\u0631\u0631\u0633\u06cc \u06a9\u0646\u06cc\u0645<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u0645\u062b\u0627\u0644:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>awk -F: '\n$7 !~ \/(nologin|false|sync|shutdown|halt)$\/ {\n    print $1, $3, $6, $7\n}' \/etc\/passwd<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u06cc\u0646 \u062e\u0631\u0648\u062c\u06cc Account\u0647\u0627\u06cc\u06cc \u0631\u0627 \u0646\u0634\u0627\u0646 \u0645\u06cc\u200c\u062f\u0647\u062f \u06a9\u0647 Shell \u0622\u0646\u0647\u0627 \u0628\u0647\u200c\u0648\u0636\u0648\u062d <code>nologin<\/code> \u06cc\u0627 <code>false<\/code> \u0646\u06cc\u0633\u062a.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u0645\u0627 \u0628\u0633\u062a\u0647 \u0628\u0647 Distribution \u0628\u0627\u06cc\u062f Baseline \u0648\u0627\u0642\u0639\u06cc Server \u0631\u0627 \u062f\u0631 \u0646\u0638\u0631 \u06af\u0631\u0641\u062a.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Account\u0647\u0627\u06cc UID 0 \u0631\u0627 \u0628\u0631\u0631\u0633\u06cc \u06a9\u0646\u06cc\u0645<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u062f\u0631 Linux\u060c Root \u0645\u0639\u0645\u0648\u0644\u0627\u064b UID:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>0<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u062f\u0627\u0631\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u067e\u06cc\u062f\u0627 \u06a9\u0631\u062f\u0646 \u062a\u0645\u0627\u0645 Account\u0647\u0627\u06cc \u062f\u0627\u0631\u0627\u06cc UID \u0635\u0641\u0631:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>awk -F: '$3 == 0 {print $1 \":\" $3 \":\" $6 \":\" $7}' \/etc\/passwd<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u062f\u0631 \u0628\u06cc\u0634\u062a\u0631 Server\u0647\u0627 \u0627\u0646\u062a\u0638\u0627\u0631 \u062f\u0627\u0631\u06cc\u0645 \u0641\u0642\u0637:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>root<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u062f\u0627\u0631\u0627\u06cc UID \u0635\u0641\u0631 \u0628\u0627\u0634\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u06af\u0631 User \u062f\u06cc\u06af\u0631\u06cc UID 0 \u062f\u0627\u0631\u062f\u060c \u0628\u0627\u06cc\u062f \u0641\u0648\u0631\u0627\u064b \u062f\u0644\u06cc\u0644 \u0622\u0646 \u0628\u0631\u0631\u0633\u06cc \u0634\u0648\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0632\u0645\u0627\u0646 \u062a\u063a\u06cc\u06cc\u0631 \u0641\u0627\u06cc\u0644\u200c\u0647\u0627\u06cc Account \u0631\u0627 \u0628\u0631\u0631\u0633\u06cc \u06a9\u0646\u06cc\u0645<\/h1>\n\n\n\n<pre class=\"wp-block-code\"><code>stat \/etc\/passwd\nstat \/etc\/shadow\nstat \/etc\/group<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u06cc\u0646 Timestamp\u0647\u0627 \u0628\u0647\u200c\u062a\u0646\u0647\u0627\u06cc\u06cc \u0645\u0634\u062e\u0635 \u0646\u0645\u06cc\u200c\u06a9\u0646\u0646\u062f \u0686\u0647 User\u06cc \u0627\u06cc\u062c\u0627\u062f \u0634\u062f\u0647 \u0627\u0633\u062a\u060c \u0627\u0645\u0627 \u0628\u0631\u0627\u06cc Timeline \u0645\u0641\u06cc\u062f \u0647\u0633\u062a\u0646\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Login\u0647\u0627\u06cc \u0627\u062e\u06cc\u0631 \u0631\u0627 \u0628\u0631\u0631\u0633\u06cc \u06a9\u0646\u06cc\u0645<\/h1>\n\n\n\n<pre class=\"wp-block-code\"><code>last<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u0646\u0645\u0627\u06cc\u0634 \u0632\u0645\u0627\u0646 \u0622\u062e\u0631\u06cc\u0646 Login \u06a9\u0627\u0631\u0628\u0631\u0627\u0646:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>lastlog<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u062f\u0631 Distribution\u0647\u0627\u06cc\u06cc \u06a9\u0647 Failed Login Database \u0641\u0639\u0627\u0644 \u0628\u0627\u0634\u062f:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>lastb<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0646\u06cc\u0632 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u0645\u0641\u06cc\u062f \u0628\u0627\u0634\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0645\u0631\u062d\u0644\u0647 \u0634\u0634\u0645: \u0628\u0631\u0631\u0633\u06cc sudo \u0648 \u062f\u0633\u062a\u0631\u0633\u06cc Root<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0645\u0645\u06a9\u0646 \u0627\u0633\u062a \u0645\u0647\u0627\u062c\u0645 User \u062c\u062f\u06cc\u062f \u0646\u0633\u0627\u0632\u062f \u0627\u0645\u0627 \u0628\u0647 \u06cc\u06a9 User \u0645\u0648\u062c\u0648\u062f \u062f\u0633\u062a\u0631\u0633\u06cc sudo \u0628\u062f\u0647\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u0628\u062a\u062f\u0627 Group\u0647\u0627\u06cc \u0645\u0647\u0645 \u0631\u0627 \u0628\u0631\u0631\u0633\u06cc \u06a9\u0646\u06cc\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Ubuntu\/Debian:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>getent group sudo<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">RHEL\/AlmaLinux\/Rocky:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>getent group wheel<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0641\u0627\u06cc\u0644 sudoers \u0631\u0627 \u0628\u0631\u0631\u0633\u06cc \u06a9\u0646\u06cc\u0645<\/h1>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo less \/etc\/sudoers<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0647\u0645\u0686\u0646\u06cc\u0646:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo ls -lah \/etc\/sudoers.d\/<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u0645\u0634\u0627\u0647\u062f\u0647 Rule\u0647\u0627:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo grep -RIn . \/etc\/sudoers.d\/ 2&gt;\/dev\/null<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0641\u0627\u06cc\u0644\u200c\u0647\u0627\u06cc \u062c\u062f\u06cc\u062f \u06cc\u0627 Rule\u0647\u0627\u06cc \u0646\u0627\u0634\u0646\u0627\u062e\u062a\u0647 \u0628\u0627\u06cc\u062f \u0628\u0631\u0631\u0633\u06cc \u0634\u0648\u0646\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Syntax \u0641\u0627\u06cc\u0644 sudoers \u0631\u0627 Validate \u06a9\u0646\u06cc\u0645<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u062f\u0648\u0646 \u062a\u063a\u06cc\u06cc\u0631 Configuration:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo visudo -c<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u06cc\u0646 Command \u0635\u062d\u062a Syntax \u062a\u0646\u0638\u06cc\u0645\u0627\u062a sudoers \u0631\u0627 \u0628\u0631\u0631\u0633\u06cc \u0645\u06cc\u200c\u06a9\u0646\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Timestamp \u0641\u0627\u06cc\u0644\u200c\u0647\u0627\u06cc sudo \u0631\u0627 \u0628\u0631\u0631\u0633\u06cc \u06a9\u0646\u06cc\u0645<\/h1>\n\n\n\n<pre class=\"wp-block-code\"><code>stat \/etc\/sudoers<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0648:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>find \/etc\/sudoers.d \\\n-type f \\\n-printf '%TY-%Tm-%Td %TH:%TM %u %g %p\\n' 2&gt;\/dev\/null<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0645\u0631\u062d\u0644\u0647 \u0647\u0641\u062a\u0645: \u0628\u0631\u0631\u0633\u06cc Shell Startup File\u0647\u0627<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">Command\u0647\u0627\u06cc\u06cc \u06a9\u0647 \u0647\u0646\u06af\u0627\u0645 Login \u06cc\u0627 \u0627\u062c\u0631\u0627\u06cc Shell \u0627\u062c\u0631\u0627 \u0645\u06cc\u200c\u0634\u0648\u0646\u062f \u0646\u06cc\u0632 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u0646\u062f \u0646\u0642\u0637\u0647\u200c\u0627\u06cc \u0628\u0631\u0627\u06cc Persistence \u0628\u0627\u0634\u0646\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0641\u0627\u06cc\u0644\u200c\u0647\u0627\u06cc \u0645\u0647\u0645 \u0645\u0645\u06a9\u0646 \u0627\u0633\u062a \u0634\u0627\u0645\u0644 \u0645\u0648\u0627\u0631\u062f \u0632\u06cc\u0631 \u0628\u0627\u0634\u0646\u062f:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>\/etc\/profile\n\/etc\/profile.d\/*\n\/etc\/bash.bashrc\n\/etc\/bashrc\n~\/.profile\n~\/.bash_profile\n~\/.bashrc\n~\/.zshrc<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0648\u062c\u0648\u062f \u0647\u0645\u0647 \u0627\u06cc\u0646 \u0641\u0627\u06cc\u0644\u200c\u0647\u0627 \u0628\u0647 Distribution \u0648 Shell \u0628\u0633\u062a\u06af\u06cc \u062f\u0627\u0631\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0641\u0627\u06cc\u0644\u200c\u0647\u0627\u06cc System-wide \u0631\u0627 \u0628\u0631\u0631\u0633\u06cc \u06a9\u0646\u06cc\u0645<\/h1>\n\n\n\n<pre class=\"wp-block-code\"><code>cat \/etc\/profile<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0633\u067e\u0633:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>ls -lah \/etc\/profile.d\/<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u0641\u0627\u06cc\u0644\u200c\u0647\u0627\u06cc \u062a\u0627\u0632\u0647:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>find \/etc\/profile.d \\\n-type f \\\n-mtime -7 \\\n-ls 2&gt;\/dev\/null<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Startup File \u06a9\u0627\u0631\u0628\u0631\u0627\u0646 \u0631\u0627 \u0628\u0631\u0631\u0633\u06cc \u06a9\u0646\u06cc\u0645<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u0645\u062b\u0627\u0644:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>find \/root \/home \\\n\\( -name '.bashrc' \\\n-o -name '.bash_profile' \\\n-o -name '.profile' \\\n-o -name '.zshrc' \\) \\\n-type f \\\n-print 2&gt;\/dev\/null<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u06af\u0631 \u0641\u0627\u06cc\u0644 \u0645\u0648\u0631\u062f\u0646\u0638\u0631 \u0627\u062e\u06cc\u0631\u0627\u064b \u062a\u063a\u06cc\u06cc\u0631 \u06a9\u0631\u062f\u0647 \u0627\u0633\u062a:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>stat \/home\/user\/.bashrc<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0648 \u0645\u062d\u062a\u0648\u0627\u06cc \u0622\u0646 \u0631\u0627 \u0628\u0631\u0631\u0633\u06cc \u06a9\u0646\u06cc\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u062f\u0646\u0628\u0627\u0644 \u0686\u0647 \u0631\u0641\u062a\u0627\u0631\u0647\u0627\u06cc\u06cc \u0628\u06af\u0631\u062f\u06cc\u0645\u061f<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u062f\u0627\u062e\u0644 Startup File\u0647\u0627 \u0645\u0648\u0627\u0631\u062f \u063a\u06cc\u0631\u0645\u0646\u062a\u0638\u0631\u0647 \u0645\u0627\u0646\u0646\u062f:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>\u0627\u062c\u0631\u0627\u06cc Binary \u0646\u0627\u0634\u0646\u0627\u0633<\/li>\n\n\n\n<li>\u0627\u062c\u0631\u0627\u06cc Script \u0645\u062e\u0641\u06cc<\/li>\n\n\n\n<li>Network Command \u063a\u06cc\u0631\u0636\u0631\u0648\u0631\u06cc<\/li>\n\n\n\n<li>\u0627\u062c\u0631\u0627\u06cc \u0641\u0627\u06cc\u0644 \u0627\u0632 <code>\/tmp<\/code><\/li>\n\n\n\n<li>\u0627\u062c\u0631\u0627\u06cc \u0641\u0627\u06cc\u0644 \u0627\u0632 <code>\/dev\/shm<\/code><\/li>\n\n\n\n<li>Background Process \u0646\u0627\u0634\u0646\u0627\u0633<\/li>\n\n\n\n<li>\u062a\u063a\u06cc\u06cc\u0631 PATH \u0628\u0647 Directory \u063a\u06cc\u0631\u0642\u0627\u0628\u0644 \u0627\u0639\u062a\u0645\u0627\u062f<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0627\u06cc\u062f \u0628\u0631\u0631\u0633\u06cc \u0634\u0648\u0646\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0645\u0631\u062d\u0644\u0647 \u0647\u0634\u062a\u0645: \u0628\u0631\u0631\u0633\u06cc rc.local<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u062e\u06cc Server\u0647\u0627 \u0647\u0645\u0686\u0646\u0627\u0646 \u0627\u0632:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>\/etc\/rc.local<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0645\u06cc\u200c\u06a9\u0646\u0646\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0631\u0633\u06cc:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>ls -lah \/etc\/rc.local 2&gt;\/dev\/null<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0648:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>cat \/etc\/rc.local 2&gt;\/dev\/null<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u06af\u0631 rc-local Service \u0648\u062c\u0648\u062f \u062f\u0627\u0631\u062f:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>systemctl status rc-local.service<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Command\u0647\u0627\u06cc \u0646\u0627\u0634\u0646\u0627\u0633 \u062f\u0631 \u0627\u06cc\u0646 \u0641\u0627\u06cc\u0644 \u0628\u0627\u06cc\u062f \u0628\u0631\u0631\u0633\u06cc \u0634\u0648\u0646\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">SysV Init Script\u0647\u0627 \u0631\u0627 \u0628\u0631\u0631\u0633\u06cc \u06a9\u0646\u06cc\u0645<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0631\u0648\u06cc \u0633\u06cc\u0633\u062a\u0645\u200c\u0647\u0627\u06cc \u0642\u062f\u06cc\u0645\u06cc\u200c\u062a\u0631 \u06cc\u0627 \u0633\u06cc\u0633\u062a\u0645\u200c\u0647\u0627\u06cc\u06cc \u06a9\u0647 Compatibility \u062f\u0627\u0631\u0646\u062f:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>ls -lah \/etc\/init.d\/<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0647\u0645\u0686\u0646\u06cc\u0646:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>find \/etc\/rc*.d -type l -ls 2&gt;\/dev\/null<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Script \u062c\u062f\u06cc\u062f \u06cc\u0627 \u0646\u0627\u0634\u0646\u0627\u0633 \u062f\u0631 <code>\/etc\/init.d\/<\/code> \u0628\u0627\u06cc\u062f \u0628\u0627 Package Inventory \u0648 Change History \u0645\u0642\u0627\u06cc\u0633\u0647 \u0634\u0648\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0645\u0631\u062d\u0644\u0647 \u0646\u0647\u0645: \u0628\u0631\u0631\u0633\u06cc at Jobs<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">Linux \u0627\u0628\u0632\u0627\u0631:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>at<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0631\u0627 \u0646\u06cc\u0632 \u0628\u0631\u0627\u06cc \u0627\u062c\u0631\u0627\u06cc Job \u062f\u0631 \u0632\u0645\u0627\u0646 \u0645\u0634\u062e\u0635 \u0627\u0631\u0627\u0626\u0647 \u0645\u06cc\u200c\u06a9\u0646\u062f \u0648 MITRE ATT&amp;CK \u0646\u06cc\u0632 \u0633\u0648\u0621\u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0627\u0632 \u0622\u0646 \u0631\u0627 \u062f\u0631 Scheduled Task\/Job \u067e\u0648\u0634\u0634 \u0645\u06cc\u200c\u062f\u0647\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u0645\u0634\u0627\u0647\u062f\u0647 Job\u0647\u0627\u06cc \u0645\u0648\u062c\u0648\u062f:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>atq<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc Root:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo atq<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0648\u062c\u0648\u062f Job \u0646\u0627\u0634\u0646\u0627\u0633 \u0628\u0627\u06cc\u062f \u0628\u0631\u0631\u0633\u06cc \u0634\u0648\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0645\u0631\u062d\u0644\u0647 \u062f\u0647\u0645: \u0628\u0631\u0631\u0633\u06cc \u0641\u0627\u06cc\u0644\u200c\u0647\u0627\u06cc Dynamic Loader<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u06cc\u06a9\u06cc \u0627\u0632 \u0646\u0642\u0627\u0637 \u062d\u0633\u0627\u0633\u200c\u062a\u0631 Linux:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>\/etc\/ld.so.preload<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u0633\u062a.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u06af\u0631 \u0627\u06cc\u0646 \u0641\u0627\u06cc\u0644 \u0648\u062c\u0648\u062f \u062f\u0627\u0631\u062f\u060c \u0627\u0628\u062a\u062f\u0627 \u0641\u0642\u0637 \u0622\u0646 \u0631\u0627 \u0628\u0631\u0631\u0633\u06cc \u06a9\u0646\u06cc\u062f:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>ls -lah \/etc\/ld.so.preload 2&gt;\/dev\/null<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0648:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>cat \/etc\/ld.so.preload 2&gt;\/dev\/null<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0647\u0631 Library \u0646\u0627\u0634\u0646\u0627\u062e\u062a\u0647\u200c\u0627\u06cc \u06a9\u0647 \u062f\u0631 \u0627\u06cc\u0646 \u0641\u0627\u06cc\u0644 \u062a\u0639\u0631\u06cc\u0641 \u0634\u062f\u0647 \u0628\u0627\u0634\u062f \u0628\u0627\u06cc\u062f \u0628\u0647\u200c\u062f\u0642\u062a \u0628\u0631\u0631\u0633\u06cc \u0634\u0648\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u0641\u0627\u06cc\u0644 Library:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>stat \/path\/to\/library.so<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0648:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sha256sum \/path\/to\/library.so<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0647 \u062f\u0644\u06cc\u0644 \u062d\u0633\u0627\u0633\u06cc\u062a Dynamic Loader\u060c \u062a\u063a\u06cc\u06cc\u0631 \u0627\u06cc\u0646 \u0642\u0633\u0645\u062a \u0646\u0628\u0627\u06cc\u062f \u0628\u062f\u0648\u0646 Change Record \u0645\u0634\u062e\u0635 \u0648\u062c\u0648\u062f \u062f\u0627\u0634\u062a\u0647 \u0628\u0627\u0634\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0645\u0631\u062d\u0644\u0647 \u06cc\u0627\u0632\u062f\u0647\u0645: \u0628\u0631\u0631\u0633\u06cc PAM<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">PAM \u0645\u0633\u0626\u0648\u0644 \u0628\u062e\u0634 \u0645\u0647\u0645\u06cc \u0627\u0632 Authentication \u062f\u0631 Linux \u0627\u0633\u062a.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Configuration \u0645\u0639\u0645\u0648\u0644\u0627\u064b \u062f\u0631:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>\/etc\/pam.d\/<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0642\u0631\u0627\u0631 \u062f\u0627\u0631\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u0645\u0634\u0627\u0647\u062f\u0647 \u0641\u0627\u06cc\u0644\u200c\u0647\u0627\u06cc \u0627\u062e\u06cc\u0631:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>find \/etc\/pam.d \\\n-type f \\\n-printf '%TY-%Tm-%Td %TH:%TM %u %g %p\\n' 2&gt;\/dev\/null | sort<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u06af\u0631 \u06cc\u06a9\u06cc \u0627\u0632 \u0641\u0627\u06cc\u0644\u200c\u0647\u0627 \u0627\u062e\u06cc\u0631\u0627\u064b \u0648 \u0628\u062f\u0648\u0646 Change Plan \u062a\u063a\u06cc\u06cc\u0631 \u06a9\u0631\u062f\u0647 \u0628\u0627\u0634\u062f\u060c \u0628\u0627\u06cc\u062f \u0628\u0631\u0631\u0633\u06cc \u0634\u0648\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0645\u0631\u062d\u0644\u0647 \u062f\u0648\u0627\u0632\u062f\u0647\u0645: Kernel Module\u0647\u0627 \u0631\u0627 \u0628\u0631\u0631\u0633\u06cc \u06a9\u0646\u06cc\u0645<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u0645\u0634\u0627\u0647\u062f\u0647 Module\u0647\u0627\u06cc Load \u0634\u062f\u0647:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>lsmod<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Configuration \u0645\u0631\u0628\u0648\u0637 \u0628\u0647 Module\u0647\u0627\u06cc\u06cc \u06a9\u0647 \u062f\u0631 Boot Load \u0645\u06cc\u200c\u0634\u0648\u0646\u062f \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u062f\u0631 \u0645\u0633\u06cc\u0631\u0647\u0627\u06cc\u06cc \u0645\u0627\u0646\u0646\u062f:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>\/etc\/modules\n\/etc\/modules-load.d\/<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0648\u062c\u0648\u062f \u062f\u0627\u0634\u062a\u0647 \u0628\u0627\u0634\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0631\u0633\u06cc:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>cat \/etc\/modules 2&gt;\/dev\/null<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0648:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>ls -lah \/etc\/modules-load.d\/ 2&gt;\/dev\/null<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0647\u0631 Module \u0646\u0627\u0634\u0646\u0627\u062e\u062a\u0647 \u0628\u0627\u06cc\u062f \u0628\u0627 Package \u0648 Kernel Baseline \u0633\u06cc\u0633\u062a\u0645 \u0645\u0642\u0627\u06cc\u0633\u0647 \u0634\u0648\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Process\u0647\u0627\u06cc \u0641\u0639\u0644\u06cc \u0631\u0627 \u0628\u0631\u0631\u0633\u06cc \u06a9\u0646\u06cc\u0645<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">Persistence Mechanism \u0645\u0639\u0645\u0648\u0644\u0627\u064b \u062f\u0631 \u0646\u0647\u0627\u06cc\u062a \u06cc\u06a9 Process \u0627\u062c\u0631\u0627 \u0645\u06cc\u200c\u06a9\u0646\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u0645\u0634\u0627\u0647\u062f\u0647 Process Tree:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>ps auxf<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u06cc\u0627:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>pstree -ap<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0647\u200c\u062e\u0635\u0648\u0635 \u0645\u0648\u0627\u0631\u062f \u0632\u06cc\u0631 \u0645\u0647\u0645\u200c\u0627\u0646\u062f:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Unknown Process\nUnexpected Parent\nRoot Process\nExecutable from unusual path\nExternal Network Connection<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Connection\u0647\u0627\u06cc \u0634\u0628\u06a9\u0647 \u0631\u0627 \u0628\u0631\u0631\u0633\u06cc \u06a9\u0646\u06cc\u0645<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u0645\u0634\u0627\u0647\u062f\u0647 TCP Connection\u0647\u0627 \u0647\u0645\u0631\u0627\u0647 PID:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>ss -plant<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc UDP:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>ss -planu<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u06af\u0631 Process \u0645\u0631\u0628\u0648\u0637 \u0628\u0647 Service \u06cc\u0627 Job \u0646\u0627\u0634\u0646\u0627\u0633 \u0628\u0647 IP \u062e\u0627\u0631\u062c\u06cc \u0645\u062a\u0635\u0644 \u0627\u0633\u062a\u060c Investigation \u0628\u0627\u06cc\u062f \u0627\u062f\u0627\u0645\u0647 \u067e\u06cc\u062f\u0627 \u06a9\u0646\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Executable \u0648\u0627\u0642\u0639\u06cc Process \u0631\u0627 \u067e\u06cc\u062f\u0627 \u06a9\u0646\u06cc\u0645<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0641\u0631\u0636 \u06a9\u0646\u06cc\u0645 PID \u0645\u0634\u06a9\u0648\u06a9:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>6240<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u0633\u062a.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0645\u0633\u06cc\u0631 Executable:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>readlink -f \/proc\/6240\/exe<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Command Line:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>tr '\\0' ' ' &lt; \/proc\/6240\/cmdline<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Parent PID:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>grep PPid \/proc\/6240\/status<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Working Directory:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>readlink -f \/proc\/6240\/cwd<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u06cc\u0646 \u0627\u0637\u0644\u0627\u0639\u0627\u062a \u0628\u0631\u0627\u06cc \u0645\u0634\u062e\u0635 \u06a9\u0631\u062f\u0646 \u0645\u0646\u0634\u0623 Process \u0628\u0633\u06cc\u0627\u0631 \u0645\u0641\u06cc\u062f \u0647\u0633\u062a\u0646\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0641\u0627\u06cc\u0644\u200c\u0647\u0627\u06cc \u062a\u0627\u0632\u0647 \u0627\u06cc\u062c\u0627\u062f\u0634\u062f\u0647 \u062f\u0631 \u0645\u0633\u06cc\u0631\u0647\u0627\u06cc Persistence<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0645\u06cc\u200c\u062a\u0648\u0627\u0646 \u0686\u0646\u062f \u0645\u0633\u06cc\u0631 \u0645\u0647\u0645 \u0631\u0627 \u0647\u0645\u0632\u0645\u0627\u0646 \u0628\u0631\u0631\u0633\u06cc \u06a9\u0631\u062f:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>find \\\n\/etc\/systemd\/system \\\n\/etc\/cron.d \\\n\/etc\/profile.d \\\n\/etc\/sudoers.d \\\n-type f \\\n-mtime -7 \\\n-ls 2&gt;\/dev\/null<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0639\u062f\u062f:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>7<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u06cc\u0639\u0646\u06cc \u0641\u0627\u06cc\u0644\u200c\u0647\u0627\u06cc\u06cc \u06a9\u0647 \u062f\u0631 \u0647\u0641\u062a \u0631\u0648\u0632 \u0627\u062e\u06cc\u0631 Modification \u062f\u0627\u0634\u062a\u0647\u200c\u0627\u0646\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0627\u0632\u0647 \u0631\u0627 \u0628\u0631\u0627\u0633\u0627\u0633 Timeline Incident \u062a\u063a\u06cc\u06cc\u0631 \u062f\u0647\u06cc\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0641\u0627\u06cc\u0644\u200c\u0647\u0627\u06cc \u0645\u0634\u06a9\u0648\u06a9 \u062f\u0631 \/tmp \u0648 \/dev\/shm<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u06cc\u0646 Directory\u0647\u0627 \u0628\u0647\u200c\u0637\u0648\u0631 \u0637\u0628\u06cc\u0639\u06cc \u0641\u0627\u06cc\u0644 \u062f\u0627\u0631\u0646\u062f\u060c \u0627\u0645\u0627 Executable \u06cc\u0627 Script \u0646\u0627\u0634\u0646\u0627\u0633 \u062f\u0631 \u0622\u0646\u0647\u0627 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u0646\u06cc\u0627\u0632\u0645\u0646\u062f \u0628\u0631\u0631\u0633\u06cc \u0628\u0627\u0634\u062f.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>find \/tmp \/dev\/shm \\\n-type f \\\n-mtime -7 \\\n-ls 2&gt;\/dev\/null<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0641\u0642\u0637 \u0628\u0631\u0627\u0633\u0627\u0633 \u0648\u062c\u0648\u062f \u0641\u0627\u06cc\u0644 \u0646\u062a\u06cc\u062c\u0647\u200c\u06af\u06cc\u0631\u06cc \u0646\u06a9\u0646\u06cc\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0627\u06cc\u062f Owner\u060c Hash\u060c Process \u0648 Usage \u0622\u0646 \u0631\u0627 \u0628\u0631\u0631\u0633\u06cc \u06a9\u0646\u06cc\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Log\u0647\u0627\u06cc Cron \u0631\u0627 \u0628\u0631\u0631\u0633\u06cc \u06a9\u0646\u06cc\u0645<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0631\u0648\u06cc Ubuntu\/Debian \u0645\u0645\u06a9\u0646 \u0627\u0633\u062a Cron Activity \u062f\u0631:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>\/var\/log\/syslog<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u062f\u06cc\u062f\u0647 \u0634\u0648\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u0645\u062b\u0627\u0644:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>grep CRON \/var\/log\/syslog 2&gt;\/dev\/null | tail -100<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0631\u0648\u06cc \u0628\u0639\u0636\u06cc Distribution\u0647\u0627\u06cc RHEL-based:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>grep CROND \/var\/log\/cron 2&gt;\/dev\/null | tail -100<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0627 systemd \u0646\u06cc\u0632 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646 \u0627\u0632 Journal \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u06a9\u0631\u062f:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>journalctl --since \"24 hours ago\" | grep -i cron<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Log\u0647\u0627\u06cc SSH \u0631\u0627 \u0628\u0631\u0631\u0633\u06cc \u06a9\u0646\u06cc\u0645<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">Ubuntu\/Debian:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>grep sshd \/var\/log\/auth.log 2&gt;\/dev\/null | tail -100<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">RHEL\/AlmaLinux\/Rocky:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>grep sshd \/var\/log\/secure 2&gt;\/dev\/null | tail -100<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u06cc\u0627:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>journalctl -u ssh --since \"24 hours ago\"<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0648 \u0628\u0633\u062a\u0647 \u0628\u0647 Distribution:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>journalctl -u sshd --since \"24 hours ago\"<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u06af\u0631 SSH Key \u0646\u0627\u0634\u0646\u0627\u0633 \u067e\u06cc\u062f\u0627 \u06a9\u0631\u062f\u06cc\u062f\u060c Login\u0647\u0627\u06cc \u0645\u0631\u0628\u0648\u0637 \u0628\u0647 \u0647\u0645\u0627\u0646 User \u0648 Source IP \u0631\u0627 \u0646\u06cc\u0632 \u0628\u0631\u0631\u0633\u06cc \u06a9\u0646\u06cc\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">auditd \u0686\u0647 \u06a9\u0645\u06a9\u06cc \u0645\u06cc\u200c\u06a9\u0646\u062f\u061f<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u06af\u0631 Linux Audit \u0642\u0628\u0644\u0627\u064b \u0631\u0648\u06cc Server \u0641\u0639\u0627\u0644 \u0648 Rule\u0647\u0627\u06cc \u0645\u0646\u0627\u0633\u0628 \u062a\u0639\u0631\u06cc\u0641 \u0634\u062f\u0647 \u0628\u0627\u0634\u0646\u062f\u060c \u0645\u06cc\u200c\u062a\u0648\u0627\u0646 \u062a\u063a\u06cc\u06cc\u0631\u0627\u062a \u0641\u0627\u06cc\u0644\u200c\u0647\u0627 \u0648 Account\u0647\u0627 \u0631\u0627 \u0628\u0647\u062a\u0631 \u0628\u0631\u0631\u0633\u06cc \u06a9\u0631\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u0628\u0632\u0627\u0631:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>ausearch<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u062c\u0633\u062a\u062c\u0648 \u062f\u0631 Audit Event\u0647\u0627 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0645\u06cc\u200c\u0634\u0648\u062f \u0648 \u0645\u0639\u0645\u0648\u0644\u0627\u064b \u062f\u0627\u062f\u0647\u200c\u0647\u0627\u06cc <code>\/var\/log\/audit\/audit.log<\/code> \u0631\u0627 Query \u0645\u06cc\u200c\u06a9\u0646\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u0645\u062b\u0627\u0644 \u0628\u0631\u0631\u0633\u06cc \u062a\u063a\u06cc\u06cc\u0631\u0627\u062a Account:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>ausearch -m ADD_USER,DEL_USER,ADD_GROUP,DEL_GROUP -i<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u0645\u0627 \u0646\u06a9\u062a\u0647 \u0645\u0647\u0645 \u0627\u06cc\u0646 \u0627\u0633\u062a:<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p class=\"wp-block-paragraph\">auditd \u0641\u0642\u0637 Event\u0647\u0627\u06cc\u06cc \u0631\u0627 \u0646\u0634\u0627\u0646 \u0645\u06cc\u200c\u062f\u0647\u062f \u06a9\u0647 \u062f\u0631 \u0632\u0645\u0627\u0646 \u0648\u0642\u0648\u0639 \u0642\u0627\u0628\u0644 \u062b\u0628\u062a \u0628\u0648\u062f\u0647\u200c\u0627\u0646\u062f\u061b \u0641\u0639\u0627\u0644 \u06a9\u0631\u062f\u0646 Auditing \u0628\u0639\u062f \u0627\u0632 Incident\u060c Event\u0647\u0627\u06cc \u06af\u0630\u0634\u062a\u0647 \u0631\u0627 \u0627\u06cc\u062c\u0627\u062f \u0646\u0645\u06cc\u200c\u06a9\u0646\u062f.<\/p>\n<\/blockquote>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0628\u0631\u0627\u06cc \u0622\u06cc\u0646\u062f\u0647 \u0645\u0633\u06cc\u0631\u0647\u0627\u06cc \u062d\u0633\u0627\u0633 \u0631\u0627 Audit \u06a9\u0646\u06cc\u0645<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u062f\u0631 Server\u0647\u0627\u06cc \u062d\u0633\u0627\u0633 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646 \u062a\u063a\u06cc\u06cc\u0631\u0627\u062a \u0646\u0642\u0627\u0637 Persistence \u0631\u0627 \u0645\u0627\u0646\u06cc\u062a\u0648\u0631 \u06a9\u0631\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0645\u062b\u0644\u0627\u064b \u0628\u0627 Policy \u0645\u0646\u0627\u0633\u0628 Audit Framework \u0633\u0627\u0632\u0645\u0627\u0646 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646 \u0645\u0633\u06cc\u0631\u0647\u0627\u06cc\u06cc \u0645\u0627\u0646\u0646\u062f:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>\/etc\/systemd\/system\/\n\/etc\/cron.d\/\n\/etc\/sudoers.d\/\n\/root\/.ssh\/\n\/etc\/ssh\/<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0631\u0627 \u062a\u062d\u062a File Integrity Monitoring \u0642\u0631\u0627\u0631 \u062f\u0627\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u0645\u062d\u06cc\u0637 Production \u0627\u0628\u0632\u0627\u0631\u0647\u0627\u06cc\u06cc \u0645\u0627\u0646\u0646\u062f:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>auditd\nWazuh\nAIDE\nosquery\nEDR\nSIEM<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u0646\u062f \u0645\u0641\u06cc\u062f \u0628\u0627\u0634\u0646\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Package Integrity \u0631\u0627 \u0628\u0631\u0631\u0633\u06cc \u06a9\u0646\u06cc\u0645<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u06af\u0631 \u0641\u0627\u06cc\u0644 \u0633\u06cc\u0633\u062a\u0645\u06cc \u0645\u0634\u06a9\u0648\u06a9 \u0627\u0633\u062a\u060c \u0628\u0631\u0631\u0633\u06cc \u06a9\u0646\u06cc\u062f \u0645\u062a\u0639\u0644\u0642 \u0628\u0647 \u06a9\u062f\u0627\u0645 Package \u0627\u0633\u062a.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Ubuntu \/ Debian<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code>dpkg -S \/path\/to\/file<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0631\u0633\u06cc Package File\u0647\u0627:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>dpkg -V package-name<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u062f\u0631 \u0635\u0648\u0631\u062a \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0627\u0632 <code>debsums<\/code> \u0646\u06cc\u0632 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646 Integrity \u0641\u0627\u06cc\u0644\u200c\u0647\u0627\u06cc Package \u0631\u0627 \u0628\u0631\u0631\u0633\u06cc \u06a9\u0631\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">AlmaLinux \/ Rocky \/ RHEL<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u067e\u06cc\u062f\u0627 \u06a9\u0631\u062f\u0646 Package:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>rpm -qf \/path\/to\/file<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0631\u0633\u06cc Integrity Package:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>rpm -V package-name<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u06af\u0631 \u0641\u0627\u06cc\u0644 \u0633\u06cc\u0633\u062a\u0645\u06cc \u062a\u063a\u06cc\u06cc\u0631 \u06a9\u0631\u062f\u0647 \u0627\u0633\u062a\u060c \u0646\u062a\u06cc\u062c\u0647 \u0631\u0627 \u0628\u0627 Update\u0647\u0627 \u0648 Change History \u0645\u0642\u0627\u06cc\u0633\u0647 \u06a9\u0646\u06cc\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u06cc\u06a9 Workflow \u0639\u0645\u0644\u06cc \u0628\u0631\u0627\u06cc \u0628\u0631\u0631\u0633\u06cc Persistence<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u06af\u0631 \u0627\u062d\u062a\u0645\u0627\u0644 Compromise \u0648\u062c\u0648\u062f \u062f\u0627\u0631\u062f\u060c \u0645\u06cc\u200c\u062a\u0648\u0627\u0646 \u0628\u0631\u0631\u0633\u06cc \u0631\u0627 \u0628\u0627 \u0627\u06cc\u0646 \u062a\u0631\u062a\u06cc\u0628 \u0627\u0646\u062c\u0627\u0645 \u062f\u0627\u062f.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">\u0645\u0631\u062d\u0644\u0647 1: Process \u0648 Network<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code>ps auxf<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code>ss -plant<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">\u0645\u0631\u062d\u0644\u0647 2: Cron<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code>crontab -l<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo crontab -l<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code>ls -lah \/etc\/cron.d\/<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">\u0645\u0631\u062d\u0644\u0647 3: systemd Services<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code>systemctl list-unit-files --type=service --state=enabled<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code>systemctl list-units --type=service --state=running<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">\u0645\u0631\u062d\u0644\u0647 4: systemd Timers<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code>systemctl list-timers --all<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">\u0645\u0631\u062d\u0644\u0647 5: SSH Keys<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code>find \/root \/home \\\n-path '*\/.ssh\/authorized_keys' \\\n-type f \\\n-print 2&gt;\/dev\/null<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">\u0645\u0631\u062d\u0644\u0647 6: User\u0647\u0627<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code>awk -F: '$3 == 0 {print}' \/etc\/passwd<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code>getent passwd<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">\u0645\u0631\u062d\u0644\u0647 7: sudo<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code>getent group sudo<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u06cc\u0627:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>getent group wheel<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0633\u067e\u0633:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>ls -lah \/etc\/sudoers.d\/<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">\u0645\u0631\u062d\u0644\u0647 8: Shell Startup<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code>find \/root \/home \\\n\\( -name '.bashrc' \\\n-o -name '.bash_profile' \\\n-o -name '.profile' \\\n-o -name '.zshrc' \\) \\\n-type f \\\n-print 2&gt;\/dev\/null<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">\u0645\u0631\u062d\u0644\u0647 9: at<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code>atq<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">\u0645\u0631\u062d\u0644\u0647 10: Recent Changes<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code>find \\\n\/etc\/systemd\/system \\\n\/etc\/cron.d \\\n\/etc\/profile.d \\\n\/etc\/sudoers.d \\\n-type f \\\n-mtime -7 \\\n-ls 2&gt;\/dev\/null<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u06cc\u06a9 Command \u062e\u0644\u0627\u0635\u0647 \u0628\u0631\u0627\u06cc \u0628\u0631\u0631\u0633\u06cc \u0627\u0648\u0644\u06cc\u0647<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0645\u06cc\u200c\u062a\u0648\u0627\u0646 \u0686\u0646\u062f \u0645\u0648\u0631\u062f \u0627\u0635\u0644\u06cc \u0631\u0627 \u067e\u0634\u062a \u0633\u0631 \u0647\u0645 \u0646\u0645\u0627\u06cc\u0634 \u062f\u0627\u062f:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>echo \"=== RUNNING SERVICES ===\"\nsystemctl list-units --type=service --state=running\n\necho\necho \"=== ENABLED SERVICES ===\"\nsystemctl list-unit-files --type=service --state=enabled\n\necho\necho \"=== TIMERS ===\"\nsystemctl list-timers --all\n\necho\necho \"=== ROOT CRON ===\"\ncrontab -u root -l 2&gt;\/dev\/null\n\necho\necho \"=== UID 0 USERS ===\"\nawk -F: '$3 == 0 {print}' \/etc\/passwd\n\necho\necho \"=== SSH AUTHORIZED KEYS ===\"\nfind \/root \/home -path '*\/.ssh\/authorized_keys' -type f -print 2&gt;\/dev\/null\n\necho\necho \"=== AT JOBS ===\"\natq 2&gt;\/dev\/null<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u06cc\u0646 \u062f\u0633\u062a\u0648\u0631\u0627\u062a \u0641\u0642\u0637 \u0628\u0631\u0627\u06cc Inventory \u0627\u0648\u0644\u06cc\u0647 \u0647\u0633\u062a\u0646\u062f \u0648 \u0686\u06cc\u0632\u06cc \u0631\u0627 \u0627\u0632 \u0633\u06cc\u0633\u062a\u0645 \u062d\u0630\u0641 \u0646\u0645\u06cc\u200c\u06a9\u0646\u0646\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0686\u0647 \u0646\u0634\u0627\u0646\u0647\u200c\u0647\u0627\u06cc\u06cc \u0628\u06cc\u0634\u062a\u0631 \u0645\u0634\u06a9\u0648\u06a9 \u0647\u0633\u062a\u0646\u062f\u061f<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0647\u200c\u0637\u0648\u0631 \u06a9\u0644\u06cc \u062a\u0631\u06a9\u06cc\u0628 \u0686\u0646\u062f \u0645\u0648\u0631\u062f \u0627\u0632 \u0646\u0634\u0627\u0646\u0647\u200c\u0647\u0627\u06cc \u0632\u06cc\u0631 \u0627\u0647\u0645\u06cc\u062a \u0628\u06cc\u0634\u062a\u0631\u06cc \u062f\u0627\u0631\u062f:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Recently Created Service\n+\nRuns as root\n+\nExecutable in \/tmp\n+\nUnknown Owner\n+\nExternal Connection<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u06cc\u0627:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Unknown SSH Key\n+\nRoot Account\n+\nRecent Login\n+\nUnknown Source IP<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u06cc\u0627:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>New Cron Job\n+\n@reboot\n+\nHidden Script\n+\nNetwork Activity<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u06cc\u06a9 Indicator \u0628\u0647\u200c\u062a\u0646\u0647\u0627\u06cc\u06cc \u0645\u0639\u0645\u0648\u0644\u0627\u064b \u0628\u0631\u0627\u06cc \u0646\u062a\u06cc\u062c\u0647\u200c\u06af\u06cc\u0631\u06cc \u06a9\u0627\u0641\u06cc \u0646\u06cc\u0633\u062a.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0641\u0627\u06cc\u0644 \u06cc\u0627 Service \u0645\u0634\u06a9\u0648\u06a9 \u067e\u06cc\u062f\u0627 \u06a9\u0631\u062f\u06cc\u0645\u061b \u0686\u0647 \u06a9\u0646\u06cc\u0645\u061f<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0641\u0648\u0631\u0627\u064b:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>rm<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0646\u06a9\u0646\u06cc\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u0628\u062a\u062f\u0627 \u0627\u0637\u0644\u0627\u0639\u0627\u062a \u0622\u0646 \u0631\u0627 \u062b\u0628\u062a \u06a9\u0646\u06cc\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0645\u062b\u0644\u0627\u064b:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>stat \/path\/to\/file<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code>sha256sum \/path\/to\/file<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code>file \/path\/to\/file<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u06af\u0631 Process \u062f\u0631 \u062d\u0627\u0644 \u0627\u062c\u0631\u0627 \u0627\u0633\u062a:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>ps -fp PID<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code>readlink -f \/proc\/PID\/exe<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code>tr '\\0' ' ' &lt; \/proc\/PID\/cmdline<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0648 Network:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>ss -plant<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0631\u0627 \u062b\u0628\u062a \u06a9\u0646\u06cc\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u062d\u0630\u0641 \u0641\u0648\u0631\u06cc Persistence \u0686\u0647 \u0645\u0634\u06a9\u0644\u06cc \u062f\u0627\u0631\u062f\u061f<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u06af\u0631 \u0628\u0644\u0627\u0641\u0627\u0635\u0644\u0647 Service \u06cc\u0627 Cron Job \u0631\u0627 \u062d\u0630\u0641 \u06a9\u0646\u06cc\u062f \u0645\u0645\u06a9\u0646 \u0627\u0633\u062a \u0628\u062e\u0634\u06cc \u0627\u0632 Evidence \u0631\u0627 \u0627\u0632 \u0628\u06cc\u0646 \u0628\u0628\u0631\u06cc\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u062f\u0631 Incident \u0645\u0647\u0645 \u0627\u0628\u062a\u062f\u0627 \u0628\u0627\u06cc\u062f \u0645\u0634\u062e\u0635 \u0634\u0648\u062f:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>\u0686\u0647 \u0632\u0645\u0627\u0646\u06cc \u0627\u06cc\u062c\u0627\u062f \u0634\u062f\u0647\u061f<\/li>\n\n\n\n<li>\u0686\u0647 User\u06cc \u0622\u0646 \u0631\u0627 \u0627\u06cc\u062c\u0627\u062f \u06a9\u0631\u062f\u0647\u061f<\/li>\n\n\n\n<li>\u0686\u0647 \u0686\u06cc\u0632\u06cc \u0631\u0627 \u0627\u062c\u0631\u0627 \u0645\u06cc\u200c\u06a9\u0646\u062f\u061f<\/li>\n\n\n\n<li>Executable \u06a9\u062c\u0627\u0633\u062a\u061f<\/li>\n\n\n\n<li>\u0628\u0647 \u0686\u0647 IP\u0647\u0627\u06cc\u06cc \u0645\u062a\u0635\u0644 \u0634\u062f\u0647\u061f<\/li>\n\n\n\n<li>\u0686\u0647 Credential\u0647\u0627\u06cc\u06cc \u062f\u0631\u06af\u06cc\u0631 \u0628\u0648\u062f\u0647\u200c\u0627\u0646\u062f\u061f<\/li>\n\n\n\n<li>Initial Access \u0686\u0647 \u0628\u0648\u062f\u0647 \u0627\u0633\u062a\u061f<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">\u0647\u062f\u0641 \u0641\u0642\u0637 \u062d\u0630\u0641 Persistence \u0646\u06cc\u0633\u062a.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0647\u062f\u0641 \u067e\u06cc\u062f\u0627 \u06a9\u0631\u062f\u0646:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Root Cause<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u0633\u062a.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0628\u0639\u062f \u0627\u0632 \u062a\u0623\u06cc\u06cc\u062f Compromise<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u067e\u0633 \u0627\u0632 \u062d\u0641\u0638 Evidence \u0648 \u0645\u0634\u062e\u0635 \u0634\u062f\u0646 Scope\u060c \u0645\u0645\u06a9\u0646 \u0627\u0633\u062a \u0644\u0627\u0632\u0645 \u0628\u0627\u0634\u062f:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Host \u0627\u06cc\u0632\u0648\u0644\u0647 \u0634\u0648\u062f.<\/li>\n\n\n\n<li>Persistence Mechanism \u063a\u06cc\u0631\u0641\u0639\u0627\u0644 \u0634\u0648\u062f.<\/li>\n\n\n\n<li>Process \u0645\u062e\u0631\u0628 \u0645\u062a\u0648\u0642\u0641 \u0634\u0648\u062f.<\/li>\n\n\n\n<li>SSH Key \u063a\u06cc\u0631\u0645\u062c\u0627\u0632 Revoked \u0634\u0648\u062f.<\/li>\n\n\n\n<li>Account \u063a\u06cc\u0631\u0645\u062c\u0627\u0632 Disable \u0634\u0648\u062f.<\/li>\n\n\n\n<li>Password\u0647\u0627 Rotate \u0634\u0648\u0646\u062f.<\/li>\n\n\n\n<li>API Token\u0647\u0627 Rotate \u0634\u0648\u0646\u062f.<\/li>\n\n\n\n<li>SSH Key\u0647\u0627\u06cc \u0645\u062f\u06cc\u0631\u06cc\u062a\u06cc \u0628\u0631\u0631\u0633\u06cc \u0634\u0648\u0646\u062f.<\/li>\n\n\n\n<li>Vulnerability \u0627\u0648\u0644\u06cc\u0647 Patch \u0634\u0648\u062f.<\/li>\n\n\n\n<li>Web Application \u0628\u0631\u0631\u0633\u06cc \u0634\u0648\u062f.<\/li>\n\n\n\n<li>Server \u0627\u0632 Backup \u0633\u0627\u0644\u0645 Restore \u0634\u0648\u062f.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u06af\u0631 \u0627\u0639\u062a\u0645\u0627\u062f \u0628\u0647 Integrity \u0633\u06cc\u0633\u062a\u0645 \u0627\u0632 \u0628\u06cc\u0646 \u0631\u0641\u062a\u0647 \u0628\u0627\u0634\u062f\u060c \u062f\u0631 Incident\u0647\u0627\u06cc \u062c\u062f\u06cc Rebuild \u06a9\u0631\u062f\u0646 Server \u0627\u0632 Image \u0633\u0627\u0644\u0645 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u0627\u0632 \u067e\u0627\u06a9\u200c\u0633\u0627\u0632\u06cc \u062f\u0633\u062a\u06cc \u0642\u0627\u0628\u0644\u200c\u0627\u0639\u062a\u0645\u0627\u062f\u062a\u0631 \u0628\u0627\u0634\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0627\u0634\u062a\u0628\u0627\u0647\u0627\u062a \u0631\u0627\u06cc\u062c<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u062e\u06cc \u0627\u0634\u062a\u0628\u0627\u0647\u0627\u062a \u0645\u062a\u062f\u0627\u0648\u0644 \u0647\u0646\u06af\u0627\u0645 \u0628\u0631\u0631\u0633\u06cc Persistence \u0639\u0628\u0627\u0631\u062a\u200c\u0627\u0646\u062f \u0627\u0632:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>\u0628\u0631\u0631\u0633\u06cc \u0641\u0642\u0637 Cron<\/li>\n\n\n\n<li>\u0628\u0631\u0631\u0633\u06cc \u0646\u06a9\u0631\u062f\u0646 systemd Timer<\/li>\n\n\n\n<li>\u0628\u0631\u0631\u0633\u06cc \u0646\u06a9\u0631\u062f\u0646 User-level systemd<\/li>\n\n\n\n<li>\u0627\u0639\u062a\u0645\u0627\u062f \u0628\u0647 \u0646\u0627\u0645 Service<\/li>\n\n\n\n<li>\u0628\u0631\u0631\u0633\u06cc \u0646\u06a9\u0631\u062f\u0646 ExecStart<\/li>\n\n\n\n<li>\u0646\u0627\u062f\u06cc\u062f\u0647 \u06af\u0631\u0641\u062a\u0646 SSH Authorized Keys<\/li>\n\n\n\n<li>\u0628\u0631\u0631\u0633\u06cc \u0641\u0642\u0637 Root<\/li>\n\n\n\n<li>\u0628\u0631\u0631\u0633\u06cc \u0646\u06a9\u0631\u062f\u0646 sudoers<\/li>\n\n\n\n<li>\u0646\u0627\u062f\u06cc\u062f\u0647 \u06af\u0631\u0641\u062a\u0646 Shell Startup File\u0647\u0627<\/li>\n\n\n\n<li>\u0628\u0631\u0631\u0633\u06cc \u0646\u06a9\u0631\u062f\u0646 at Job\u0647\u0627<\/li>\n\n\n\n<li>\u062d\u0630\u0641 \u0641\u0648\u0631\u06cc Evidence<\/li>\n\n\n\n<li>\u0646\u062a\u06cc\u062c\u0647\u200c\u06af\u06cc\u0631\u06cc \u0641\u0642\u0637 \u0628\u0631\u0627\u0633\u0627\u0633 Timestamp<\/li>\n\n\n\n<li>\u0628\u0631\u0631\u0633\u06cc \u0646\u06a9\u0631\u062f\u0646 Process\u0647\u0627\u06cc \u0641\u0639\u0627\u0644<\/li>\n\n\n\n<li>\u0628\u0631\u0631\u0633\u06cc \u0646\u06a9\u0631\u062f\u0646 Network Connection<\/li>\n\n\n\n<li>\u067e\u06cc\u062f\u0627 \u0646\u06a9\u0631\u062f\u0646 Initial Access \u0648 Root Cause<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0628\u0647\u062a\u0631\u06cc\u0646 \u0631\u0648\u0634\u200c\u0647\u0627<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u06a9\u0627\u0647\u0634 \u062e\u0637\u0631 Persistence \u062f\u0631 Linux:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Service\u0647\u0627\u06cc Enabled \u0631\u0627 Baseline \u06a9\u0646\u06cc\u062f.<\/li>\n\n\n\n<li>Cron Job\u0647\u0627 \u0631\u0627 \u0645\u0633\u062a\u0646\u062f\u0633\u0627\u0632\u06cc \u06a9\u0646\u06cc\u062f.<\/li>\n\n\n\n<li>SSH Key Inventory \u062f\u0627\u0634\u062a\u0647 \u0628\u0627\u0634\u06cc\u062f.<\/li>\n\n\n\n<li>Root Login Policy \u0645\u0634\u062e\u0635 \u062f\u0627\u0634\u062a\u0647 \u0628\u0627\u0634\u06cc\u062f.<\/li>\n\n\n\n<li>User\u0647\u0627\u06cc \u0642\u062f\u06cc\u0645\u06cc \u0631\u0627 \u062d\u0630\u0641 \u06cc\u0627 Disable \u06a9\u0646\u06cc\u062f.<\/li>\n\n\n\n<li>sudo Access \u0631\u0627 \u0645\u062d\u062f\u0648\u062f \u06a9\u0646\u06cc\u062f.<\/li>\n\n\n\n<li><code>\/etc\/systemd\/system<\/code> \u0631\u0627 \u0645\u0627\u0646\u06cc\u062a\u0648\u0631 \u06a9\u0646\u06cc\u062f.<\/li>\n\n\n\n<li><code>\/etc\/cron.d<\/code> \u0631\u0627 \u0645\u0627\u0646\u06cc\u062a\u0648\u0631 \u06a9\u0646\u06cc\u062f.<\/li>\n\n\n\n<li><code>\/etc\/sudoers.d<\/code> \u0631\u0627 \u0645\u0627\u0646\u06cc\u062a\u0648\u0631 \u06a9\u0646\u06cc\u062f.<\/li>\n\n\n\n<li>SSH Configuration \u0631\u0627 \u0645\u0627\u0646\u06cc\u062a\u0648\u0631 \u06a9\u0646\u06cc\u062f.<\/li>\n\n\n\n<li>File Integrity Monitoring \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u06a9\u0646\u06cc\u062f.<\/li>\n\n\n\n<li>Audit Logging \u0631\u0627 \u0641\u0639\u0627\u0644 \u06a9\u0646\u06cc\u062f.<\/li>\n\n\n\n<li>Log\u0647\u0627 \u0631\u0627 \u0628\u0647 Server \u0645\u0631\u06a9\u0632\u06cc \u06cc\u0627 SIEM \u0627\u0631\u0633\u0627\u0644 \u06a9\u0646\u06cc\u062f.<\/li>\n\n\n\n<li>Outbound Network Traffic \u0631\u0627 \u0645\u0627\u0646\u06cc\u062a\u0648\u0631 \u06a9\u0646\u06cc\u062f.<\/li>\n\n\n\n<li>Patch Management \u062f\u0627\u0634\u062a\u0647 \u0628\u0627\u0634\u06cc\u062f.<\/li>\n\n\n\n<li>Least Privilege \u0631\u0627 \u0631\u0639\u0627\u06cc\u062a \u06a9\u0646\u06cc\u062f.<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0686\u06a9\u200c\u0644\u06cc\u0633\u062a<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0647\u0646\u06af\u0627\u0645 \u0628\u0631\u0631\u0633\u06cc Persistence \u0631\u0648\u06cc Linux Server \u0645\u0648\u0627\u0631\u062f \u0632\u06cc\u0631 \u0631\u0627 \u06a9\u0646\u062a\u0631\u0644 \u06a9\u0646\u06cc\u062f:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Process\u0647\u0627\u06cc \u0641\u0639\u0627\u0644 \u0628\u0631\u0631\u0633\u06cc \u0634\u062f\u0647\u200c\u0627\u0646\u062f.<\/li>\n\n\n\n<li>Connection\u0647\u0627\u06cc \u0634\u0628\u06a9\u0647 \u0628\u0631\u0631\u0633\u06cc \u0634\u062f\u0647\u200c\u0627\u0646\u062f.<\/li>\n\n\n\n<li>Root Crontab \u0628\u0631\u0631\u0633\u06cc \u0634\u062f\u0647 \u0627\u0633\u062a.<\/li>\n\n\n\n<li>Crontab \u062a\u0645\u0627\u0645 User\u0647\u0627 \u0628\u0631\u0631\u0633\u06cc \u0634\u062f\u0647 \u0627\u0633\u062a.<\/li>\n\n\n\n<li><code>\/etc\/crontab<\/code> \u0628\u0631\u0631\u0633\u06cc \u0634\u062f\u0647 \u0627\u0633\u062a.<\/li>\n\n\n\n<li><code>\/etc\/cron.d<\/code> \u0628\u0631\u0631\u0633\u06cc \u0634\u062f\u0647 \u0627\u0633\u062a.<\/li>\n\n\n\n<li><code>@reboot<\/code> \u0628\u0631\u0631\u0633\u06cc \u0634\u062f\u0647 \u0627\u0633\u062a.<\/li>\n\n\n\n<li>Service\u0647\u0627\u06cc Enabled \u0628\u0631\u0631\u0633\u06cc \u0634\u062f\u0647\u200c\u0627\u0646\u062f.<\/li>\n\n\n\n<li>Service\u0647\u0627\u06cc Running \u0628\u0631\u0631\u0633\u06cc \u0634\u062f\u0647\u200c\u0627\u0646\u062f.<\/li>\n\n\n\n<li>Unit File\u0647\u0627\u06cc \u062c\u062f\u06cc\u062f \u0628\u0631\u0631\u0633\u06cc \u0634\u062f\u0647\u200c\u0627\u0646\u062f.<\/li>\n\n\n\n<li>ExecStart Service\u0647\u0627\u06cc \u0646\u0627\u0634\u0646\u0627\u0633 \u0628\u0631\u0631\u0633\u06cc \u0634\u062f\u0647 \u0627\u0633\u062a.<\/li>\n\n\n\n<li>systemd Timer\u0647\u0627 \u0628\u0631\u0631\u0633\u06cc \u0634\u062f\u0647\u200c\u0627\u0646\u062f.<\/li>\n\n\n\n<li>User-level systemd Unit\u0647\u0627 \u0628\u0631\u0631\u0633\u06cc \u0634\u062f\u0647\u200c\u0627\u0646\u062f.<\/li>\n\n\n\n<li>SSH Authorized Keys \u062a\u0645\u0627\u0645 User\u0647\u0627 \u0628\u0631\u0631\u0633\u06cc \u0634\u062f\u0647\u200c\u0627\u0646\u062f.<\/li>\n\n\n\n<li>SSH Configuration \u0628\u0631\u0631\u0633\u06cc \u0634\u062f\u0647 \u0627\u0633\u062a.<\/li>\n\n\n\n<li>User\u0647\u0627\u06cc \u062f\u0627\u0631\u0627\u06cc UID 0 \u0628\u0631\u0631\u0633\u06cc \u0634\u062f\u0647\u200c\u0627\u0646\u062f.<\/li>\n\n\n\n<li>User\u0647\u0627\u06cc \u062c\u062f\u06cc\u062f \u0628\u0631\u0631\u0633\u06cc \u0634\u062f\u0647\u200c\u0627\u0646\u062f.<\/li>\n\n\n\n<li>sudo \u0648 wheel Group \u0628\u0631\u0631\u0633\u06cc \u0634\u062f\u0647\u200c\u0627\u0646\u062f.<\/li>\n\n\n\n<li><code>\/etc\/sudoers.d<\/code> \u0628\u0631\u0631\u0633\u06cc \u0634\u062f\u0647 \u0627\u0633\u062a.<\/li>\n\n\n\n<li>Shell Startup File\u0647\u0627 \u0628\u0631\u0631\u0633\u06cc \u0634\u062f\u0647\u200c\u0627\u0646\u062f.<\/li>\n\n\n\n<li><code>rc.local<\/code> \u0628\u0631\u0631\u0633\u06cc \u0634\u062f\u0647 \u0627\u0633\u062a.<\/li>\n\n\n\n<li><code>at<\/code> Job\u0647\u0627 \u0628\u0631\u0631\u0633\u06cc \u0634\u062f\u0647\u200c\u0627\u0646\u062f.<\/li>\n\n\n\n<li><code>\/etc\/ld.so.preload<\/code> \u0628\u0631\u0631\u0633\u06cc \u0634\u062f\u0647 \u0627\u0633\u062a.<\/li>\n\n\n\n<li>PAM Configuration \u0628\u0631\u0631\u0633\u06cc \u0634\u062f\u0647 \u0627\u0633\u062a.<\/li>\n\n\n\n<li>Kernel Module\u0647\u0627\u06cc \u063a\u06cc\u0631\u0645\u0646\u062a\u0638\u0631\u0647 \u0628\u0631\u0631\u0633\u06cc \u0634\u062f\u0647\u200c\u0627\u0646\u062f.<\/li>\n\n\n\n<li>\u0641\u0627\u06cc\u0644\u200c\u0647\u0627\u06cc Recent \u062f\u0631 \u0645\u0633\u06cc\u0631\u0647\u0627\u06cc Persistence \u0628\u0631\u0631\u0633\u06cc \u0634\u062f\u0647\u200c\u0627\u0646\u062f.<\/li>\n\n\n\n<li>Login Log\u0647\u0627 \u0628\u0631\u0631\u0633\u06cc \u0634\u062f\u0647\u200c\u0627\u0646\u062f.<\/li>\n\n\n\n<li>Package Integrity \u0628\u0631\u0631\u0633\u06cc \u0634\u062f\u0647 \u0627\u0633\u062a.<\/li>\n\n\n\n<li>Evidence \u0642\u0628\u0644 \u0627\u0632 \u062d\u0630\u0641 \u0641\u0627\u06cc\u0644\u200c\u0647\u0627 \u062b\u0628\u062a \u0634\u062f\u0647 \u0627\u0633\u062a.<\/li>\n\n\n\n<li>Root Cause \u0645\u0634\u062e\u0635 \u0634\u062f\u0647 \u0627\u0633\u062a.<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0645\u0637\u0627\u0644\u0639\u0627\u062a \u0628\u06cc\u0634\u062a\u0631<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u0645\u0637\u0627\u0644\u0639\u0647 \u0628\u06cc\u0634\u062a\u0631 \u062f\u0631\u0628\u0627\u0631\u0647 \u0645\u06a9\u0627\u0646\u06cc\u0632\u0645\u200c\u0647\u0627\u06cc\u06cc \u06a9\u0647 \u062f\u0631 \u0627\u06cc\u0646 \u0645\u0642\u0627\u0644\u0647 \u0628\u0631\u0631\u0633\u06cc \u06a9\u0631\u062f\u06cc\u0645:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>MITRE ATT&amp;CK \u2013 Persistence<\/strong><br>\u062a\u06a9\u0646\u06cc\u06a9\u200c\u0647\u0627 \u0648 Sub-technique\u0647\u0627\u06cc \u0645\u0631\u062a\u0628\u0637 \u0628\u0627 Persistence \u062f\u0631 \u0633\u06cc\u0633\u062a\u0645\u200c\u0647\u0627\u06cc Enterprise. <a href=\"https:\/\/attack.mitre.org\/tactics\/TA0003\/?utm_source=chatgpt.com\" target=\"_blank\" rel=\"noopener\">MITRE ATT&amp;CK \u2013 Persistence<\/a><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>MITRE ATT&amp;CK \u2013 Cron<\/strong><br>\u0628\u0631\u0631\u0633\u06cc \u0633\u0648\u0621\u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0627\u0632 Cron \u0628\u0631\u0627\u06cc Scheduled Execution \u0648 Persistence. <a href=\"https:\/\/attack.mitre.org\/techniques\/T1053\/003\/?utm_source=chatgpt.com\" target=\"_blank\" rel=\"noopener\">MITRE ATT&amp;CK \u2013 Cron<\/a><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>MITRE ATT&amp;CK \u2013 Systemd Timers<\/strong><br>\u0627\u0637\u0644\u0627\u0639\u0627\u062a \u0645\u0631\u0628\u0648\u0637 \u0628\u0647 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0627\u0632 systemd Timer\u0647\u0627 \u062f\u0631 Persistence. <a href=\"https:\/\/attack.mitre.org\/techniques\/T1053\/006\/?utm_source=chatgpt.com\" target=\"_blank\" rel=\"noopener\">MITRE ATT&amp;CK \u2013 Systemd Timers<\/a><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>MITRE ATT&amp;CK \u2013 SSH Authorized Keys<\/strong><br>\u0628\u0631\u0631\u0633\u06cc \u062a\u063a\u06cc\u06cc\u0631 Authorized Keys \u0628\u0631\u0627\u06cc \u062d\u0641\u0638 \u062f\u0633\u062a\u0631\u0633\u06cc SSH. <a href=\"https:\/\/attack.mitre.org\/techniques\/T1098\/004\/?utm_source=chatgpt.com\" target=\"_blank\" rel=\"noopener\">MITRE ATT&amp;CK \u2013 SSH Authorized Keys<\/a><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Linux Manual \u2013 systemd.unit<\/strong><br>\u0645\u0633\u062a\u0646\u062f\u0627\u062a Unit File\u0647\u0627 \u0648 \u0645\u0633\u06cc\u0631\u0647\u0627\u06cc Load \u0634\u062f\u0646 Unit\u0647\u0627\u06cc systemd. <a href=\"https:\/\/man7.org\/linux\/man-pages\/man5\/systemd.unit.5.html?utm_source=chatgpt.com\" target=\"_blank\" rel=\"noopener\">systemd.unit Manual<\/a><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Linux Manual \u2013 systemd.service<\/strong><br>\u0645\u0633\u062a\u0646\u062f\u0627\u062a \u0631\u0633\u0645\u06cc \u0633\u0627\u062e\u062a\u0627\u0631 systemd Service Unit\u0647\u0627. <a href=\"https:\/\/man7.org\/linux\/man-pages\/man5\/systemd.service.5.html?utm_source=chatgpt.com\" target=\"_blank\" rel=\"noopener\">systemd.service Manual<\/a><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Linux Manual \u2013 systemd.timer<\/strong><br>\u0645\u0633\u062a\u0646\u062f\u0627\u062a Timer Unit\u0647\u0627\u06cc systemd. <a href=\"https:\/\/man7.org\/linux\/man-pages\/man5\/systemd.timer.5.html?utm_source=chatgpt.com\" target=\"_blank\" rel=\"noopener\">systemd.timer Manual<\/a><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Linux Manual \u2013 crontab<\/strong><br>\u0633\u0627\u062e\u062a\u0627\u0631 Crontab \u0648 \u0646\u062d\u0648\u0647 \u0639\u0645\u0644\u06a9\u0631\u062f Scheduled Job\u0647\u0627\u06cc Cron. <a href=\"https:\/\/man7.org\/linux\/man-pages\/man5\/crontab.5.html?utm_source=chatgpt.com\" target=\"_blank\" rel=\"noopener\">crontab Manual<\/a><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>OpenSSH \u2013 sshd_config<\/strong><br>\u0645\u0633\u062a\u0646\u062f\u0627\u062a AuthorizedKeysFile\u060c AuthorizedKeysCommand \u0648 \u062a\u0646\u0638\u06cc\u0645\u0627\u062a SSH Server. <a href=\"https:\/\/man7.org\/linux\/man-pages\/man5\/sshd_config.5.html?utm_source=chatgpt.com\" target=\"_blank\" rel=\"noopener\">sshd_config Manual<\/a><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Linux Manual \u2013 journalctl<\/strong><br>\u0645\u0633\u062a\u0646\u062f\u0627\u062a \u0628\u0631\u0631\u0633\u06cc Log\u0647\u0627\u06cc systemd Journal. <a href=\"https:\/\/man7.org\/linux\/man-pages\/man1\/journalctl.1.html?utm_source=chatgpt.com\" target=\"_blank\" rel=\"noopener\">journalctl Manual<\/a><\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u062c\u0645\u0639\u200c\u0628\u0646\u062f\u06cc<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">Persistence \u062f\u0631 Linux \u0645\u062d\u062f\u0648\u062f \u0628\u0647 \u06cc\u06a9 \u0645\u06a9\u0627\u0646 \u062e\u0627\u0635 \u0646\u06cc\u0633\u062a.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0645\u0647\u0627\u062c\u0645 \u0645\u0645\u06a9\u0646 \u0627\u0633\u062a \u0628\u0631\u0627\u06cc \u062d\u0641\u0638 \u062f\u0633\u062a\u0631\u0633\u06cc \u0627\u0632 \u0645\u06a9\u0627\u0646\u06cc\u0632\u0645\u200c\u0647\u0627\u06cc \u0642\u0627\u0646\u0648\u0646\u06cc \u0633\u06cc\u0633\u062a\u0645 \u0645\u0627\u0646\u0646\u062f:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Cron\nsystemd\nSSH\nUser Accounts\nsudo\nStartup Scripts<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0633\u0648\u0621\u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u06a9\u0646\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0647 \u0647\u0645\u06cc\u0646 \u062f\u0644\u06cc\u0644 \u0628\u0631\u0631\u0633\u06cc Persistence \u0628\u0627\u06cc\u062f \u0627\u0632 \u0686\u0646\u062f \u0628\u062e\u0634 \u0627\u0646\u062c\u0627\u0645 \u0634\u0648\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc Cron:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>crontab -l<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0648:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>ls -lah \/etc\/cron.d\/<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc Service\u0647\u0627:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>systemctl list-unit-files --type=service --state=enabled<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc Timer\u0647\u0627:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>systemctl list-timers --all<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc SSH Key\u0647\u0627:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>find \/root \/home \\\n-path '*\/.ssh\/authorized_keys' \\\n-type f \\\n-print 2&gt;\/dev\/null<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0648 \u0628\u0631\u0627\u06cc Account\u0647\u0627\u06cc \u062f\u0627\u0631\u0627\u06cc UID \u0635\u0641\u0631:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>awk -F: '$3 == 0 {print}' \/etc\/passwd<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0646\u0642\u0627\u0637 \u062f\u06cc\u06af\u0631\u06cc \u0645\u0627\u0646\u0646\u062f:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>\/etc\/sudoers.d\n\/etc\/profile.d\n\/etc\/rc.local\n\/etc\/ld.so.preload\n\/etc\/pam.d\n~\/.config\/systemd\/user<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0646\u06cc\u0632 \u062f\u0631 Investigation \u0627\u0647\u0645\u06cc\u062a \u062f\u0627\u0631\u0646\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u0645\u0627 \u067e\u06cc\u062f\u0627 \u06a9\u0631\u062f\u0646 \u06cc\u06a9 Cron Job \u06cc\u0627 Service \u0646\u0627\u0634\u0646\u0627\u0633 \u0628\u0647\u200c\u062a\u0646\u0647\u0627\u06cc\u06cc \u0627\u062b\u0628\u0627\u062a Compromise \u0646\u06cc\u0633\u062a.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0627\u06cc\u062f \u0627\u0637\u0644\u0627\u0639\u0627\u062a:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>File\nOwner\nTimestamp\nHash\nProcess\nParent Process\nNetwork Connection\nLogs<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u062f\u0631 \u06a9\u0646\u0627\u0631 \u06cc\u06a9\u062f\u06cc\u06af\u0631 \u062a\u062d\u0644\u06cc\u0644 \u0634\u0648\u0646\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u06af\u0631 Persistence \u0645\u0634\u06a9\u0648\u06a9\u06cc \u067e\u06cc\u062f\u0627 \u0634\u062f\u060c \u0642\u0628\u0644 \u0627\u0632 \u062d\u0630\u0641 \u0622\u0646 Evidence \u0631\u0627 \u062d\u0641\u0638 \u06a9\u0646\u06cc\u062f \u0648 \u0633\u067e\u0633 Initial Access \u0631\u0627 \u067e\u06cc\u062f\u0627 \u06a9\u0646\u06cc\u062f\u061b \u0632\u06cc\u0631\u0627 <strong>\u062d\u0630\u0641 Persistence \u0628\u062f\u0648\u0646 \u0628\u0631\u0637\u0631\u0641 \u06a9\u0631\u062f\u0646 Root Cause \u0645\u0645\u06a9\u0646 \u0627\u0633\u062a \u0641\u0642\u0637 \u062f\u0633\u062a\u0631\u0633\u06cc \u0641\u0639\u0644\u06cc \u0645\u0647\u0627\u062c\u0645 \u0631\u0627 \u0642\u0637\u0639 \u06a9\u0646\u062f \u0648 \u0645\u0627\u0646\u0639 \u0646\u0641\u0648\u0630 \u0645\u062c\u062f\u062f \u0646\u0634\u0648\u062f.<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u06a9\u06cc\u0627\u0646 \u067e\u0648\u0631<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n","protected":false},"excerpt":{"rendered":"<p>\u0634\u0646\u0627\u0633\u0627\u06cc\u06cc \u0631\u0648\u0634\u200c\u0647\u0627\u06cc \u0645\u0627\u0646\u062f\u06af\u0627\u0631\u06cc \u0645\u0647\u0627\u062c\u0645 \u0645\u0642\u062f\u0645\u0647 \u062f\u0631 \u0628\u0633\u06cc\u0627\u0631\u06cc \u0627\u0632 Incident\u0647\u0627\u06cc \u0627\u0645\u0646\u06cc\u062a\u06cc\u060c \u062f\u0633\u062a\u0631\u0633\u06cc \u0627\u0648\u0644\u06cc\u0647 \u0645\u0647\u0627\u062c\u0645 \u067e\u0627\u06cc\u0627\u0646 \u06a9\u0627\u0631 \u0646\u06cc\u0633\u062a. \u067e\u0633 \u0627\u0632 \u0646\u0641\u0648\u0630\u060c \u0645\u0647\u0627\u062c\u0645 \u0645\u0645\u06a9\u0646 \u0627\u0633\u062a \u062a\u0644\u0627\u0634 \u06a9\u0646\u062f \u0631\u0648\u0634\u06cc \u0627\u06cc\u062c\u0627\u062f \u06a9\u0646\u062f \u06a9\u0647 \u062d\u062a\u06cc \u0628\u0639\u062f \u0627\u0632: \u062f\u0648\u0628\u0627\u0631\u0647 \u0628\u062a\u0648\u0627\u0646\u062f \u06a9\u062f \u062e\u0648\u062f \u0631\u0627 \u0627\u062c\u0631\u0627 \u06a9\u0646\u062f \u06cc\u0627 \u0628\u0647 \u0633\u06cc\u0633\u062a\u0645 \u062f\u0633\u062a\u0631\u0633\u06cc \u062f\u0627\u0634\u062a\u0647 \u0628\u0627\u0634\u062f. \u0628\u0647 \u0627\u06cc\u0646 \u062a\u06a9\u0646\u06cc\u06a9\u200c\u0647\u0627: Persistence \u06cc\u0627 \u0645\u0627\u0646\u062f\u06af\u0627\u0631\u06cc \u062f\u0631 \u0633\u06cc\u0633\u062a\u0645 \u06af\u0641\u062a\u0647 \u0645\u06cc\u200c\u0634\u0648\u062f. \u062f\u0631 [&hellip;]<\/p>\n","protected":false},"author":3,"featured_media":22155,"parent":17595,"menu_order":60,"comment_status":"open","ping_status":"closed","template":"","doc_tag":[],"class_list":["post-22152","docs","type-docs","status-publish","has-post-thumbnail","hentry"],"acf":[],"author_avatar":"https:\/\/maralhost.com\/kb\/wp-content\/litespeed\/avatar\/c59fc140fa83b542ed78a005738a60da.jpg?ver=1790552392","author_name":"Shayan Kianpoor","_links":{"self":[{"href":"https:\/\/maralhost.com\/kb\/wp-json\/wp\/v2\/docs\/22152","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/maralhost.com\/kb\/wp-json\/wp\/v2\/docs"}],"about":[{"href":"https:\/\/maralhost.com\/kb\/wp-json\/wp\/v2\/types\/docs"}],"author":[{"embeddable":true,"href":"https:\/\/maralhost.com\/kb\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/maralhost.com\/kb\/wp-json\/wp\/v2\/comments?post=22152"}],"version-history":[{"count":2,"href":"https:\/\/maralhost.com\/kb\/wp-json\/wp\/v2\/docs\/22152\/revisions"}],"predecessor-version":[{"id":22156,"href":"https:\/\/maralhost.com\/kb\/wp-json\/wp\/v2\/docs\/22152\/revisions\/22156"}],"up":[{"embeddable":true,"href":"https:\/\/maralhost.com\/kb\/wp-json\/wp\/v2\/docs\/17595"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/maralhost.com\/kb\/wp-json\/wp\/v2\/media\/22155"}],"wp:attachment":[{"href":"https:\/\/maralhost.com\/kb\/wp-json\/wp\/v2\/media?parent=22152"}],"wp:term":[{"taxonomy":"doc_tag","embeddable":true,"href":"https:\/\/maralhost.com\/kb\/wp-json\/wp\/v2\/doc_tag?post=22152"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}