SIM EDR 003

CortexSim

Detection simulation engine for Palo Alto Networks Cortex

---

SIM-EDR-003 — Linux Persistence — Cron, Systemd, and Backdoor Users

Plane: EDR · Status: active · Version: 1.0 · Source: scenarios/edr/edr-003-persistence-mechanisms.yml

Identity & alignment

Use case	UCS-EDR-03 — Persistence Mechanism Detection
Test case	TC-EDR-03 — Linux Persistence Installation
MITRE tactic	TA0003 — Persistence
MITRE technique	T1053.003 — Scheduled Task/Job: Cron
Additional techniques	T1136.001 Create Account: Local Account, T1543.002 Create or Modify System Process: Systemd Service, T1098.004 Account Manipulation: SSH Authorized Keys
Detection types	BIOC, Analytics
Threat report	Unit42 - TeamTNT Targets Exposed Docker APIs · link
Execution identities	root, www-data, svc-backup
Push supported	✅
Pull supported	✅
External tools	—
Tags	persistence, cron, systemd, backdoor-user, ssh-keys, endpoint-security

Expected detections (10)

Step	Plane	Type	Description
step-01	EDR	BIOC	Cron job creation with suspicious command path — persistence mechanism via scheduled task
step-01	EDR	Analytics	Crontab modification from non-interactive session — automated persistence installation pattern
step-02	EDR	BIOC	Systemd service unit creation with suspicious ExecStart path — persistence via system service
step-02	EDR	Analytics	Service unit file written with restart=always and hidden binary path — malware persistence pattern
step-03	EDR	BIOC	Local account creation with sudo group membership — backdoor account for persistent access
step-03	EDR	Analytics	User account creation from non-login session — automated account provisioning pattern
step-04	EDR	BIOC	SSH key generation followed by authorized_keys write — key-based persistence installation
step-04	EDR	Analytics	ssh-keygen invocation from non-interactive session — automated SSH persistence setup
step-05	EDR	BIOC	Shell profile modification with nohup background execution — login-triggered persistence
step-05	EDR	Analytics	Shell initialization file modification pattern — persistence via user profile

Run it

# Pull mode — Go beacon agent polls SimCore for this scenario
./bin/cortexsim-agent --server http://localhost:8888 --scenario SIM-EDR-003

# Push mode — generate a self-contained bundle
curl -X POST http://localhost:8888/api/runs \
  -H "Content-Type: application/json" \
  -d '{"scenario_id":"SIM-EDR-003","mode":"push"}'
# then download the generated bundle and execute on the target

Related

• Plane overview: Plane-EDR
• ATT&CK coverage: ATT-CK-Coverage
• Validation workflow: Validation-Workflow

---

_{Author: scenario YAML last_updated field. To modify this page, edit scenarios/edr/edr-003-persistence-mechanisms.yml and resync the wiki.}