Threat report

www.elastic.co/security-labs/continuation-on-persistence-mechanisms

https://www.elastic.co/security-labs/continuation-on-persistence-mechanisms

Published on: www.elastic.co

ATT&CK techniques those detections carry

T1014Rootkit
T1037Boot or Logon Initialization Scripts
T1037.004RC Scripts
T1053Scheduled Task/Job
T1053.002At
T1053.003Cron
T1059Command and Scripting Interpreter
T1059.004Unix Shell
+21 more

2 published detections cite this

Citing it, not covering it: each of these was written with this as evidence, and carries the source it came from and the licence it was published under.

Detections citing this reference
Detection	Severity	Source	Published	Licence
Unusual Interactive Shell Launched from System User	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Potential Persistence via File Modification	Low	Elastic detection rules	Sep 20, 2026	Elastic License 2.0

Showing 2 of 2

Filter in the catalogue