Things That Run On Their Own

Getting in once is not the goal

Staying is. There is a short list of places that can run a program without a person, and checking all of them is most of the job.

Scheduled jobs

sudo ls /etc/cron.d/

Open each file you find there and read it:

sudo nano /etc/cron.d/FILENAME

A line in one of these files looks like this:

 */5 *  *  *  *  root  /usr/local/bin/something
  │              │            │
  │              │            └── what it runs
  │              └─────────────── who it runs as
  └────────────────────────────── when (*/5 = every 5 minutes)

Read the who and the when first.

💡 A job that runs every few minutes is not maintenance. Real system jobs run daily or weekly. Something running every five minutes as root is keeping something alive, and it is worth a very close look.

Two more places to check:

sudo ls /etc/cron.daily/ /etc/cron.hourly/
systemctl list-timers --all

To remove a bad one, delete the file:

sudo rm /etc/cron.d/FILENAME

Files that run when someone logs in

These do not need a scheduler. Anything added to them runs the moment a person signs in, and additions go at the bottom where nobody scrolls:

nano ~/.bashrc

Press Alt+/ to jump straight to the end of the file, and read the last few lines. Do the same for:

sudo nano /etc/profile

What "does not belong" looks like

You will not find a file called backdoor. You are looking for softer signs: a name that imitates a real system service, a script in /usr/local/bin you cannot account for, or anything that mentions a web address or an IP address inside a job that should only be doing local work.

Try it yourself

sudo ls /etc/cron.d/            # what is scheduled
sudo nano /etc/cron.d/FILENAME  # read each one
systemctl list-timers --all     # what else is on a timer
nano ~/.bashrc                  # Alt+/ to jump to the bottom