drop linux filesystem listings · cron exports · systemd unit files · ssh config · profile scripts · rc files · ld.so.preload · map every persistence mechanism · score each by suspicion · runs locally
persistence artifacts
drop cron · systemd · profiles · ssh keys
or click
drop cron · systemd · profiles · ld.so.preload · authorized_keys