SG-020: Persistence Mechanism
Severity: CRITICAL
Crontab, rc files, systemd, LaunchAgents, SSH key injection, registry run keys
Fires when
- A command installs a scheduled or boot-time job: crontab edit, cron file append, systemd service enable, at-job scheduling, Windows scheduled task, or a Windows registry Run key.
- A command appends to a shell rc startup file (~/.bashrc, ~/.zshrc, ~/.bash_profile, ~/.profile) or a system profile (/etc/profile, /etc/environment).
- A command injects an SSH key into authorized_keys, creates a macOS .plist, launches a background daemon from /tmp or a relative path (nohup ... &), or makes a temp script executable and runs it.
- A persistence LOCATION (macOS LaunchAgents/LaunchDaemons, login hook, systemd unit file path, init.d/rc.local, profile.d script) appears together with a co-located write/install verb.
Remediation
No safe remediation: a file that triggers this rule should be rejected, not patched. Read the flagged lines in the source before deciding.