drop linux artifact files · identify all persistence mechanisms · rc.local · systemd units · cron · authorized keys · ld.so.preload · profile scripts · runs locally
load artifacts
Drop extracted configs
/etc paths preserved in filenames help detection
drop rc.local · systemd units · cron · keys · preload · sudoers · profiles