Cron

Cron is quiet, trusted, and runs as root — exactly why attackers use it to survive reimaging and incident response. Learn how to audit every cron location on a Linux host, detect malicious entries with auditd, and harden cron before an attacker gets the chance.