MAL-PERSIST Persistence-Mechanism Writes
A package almost never legitimately installs a persistence mechanism. Author-planted malware routinely does, because it wants to survive a reboot, a new shell, or a re-clone by writing itself into a boot, login, or scheduler surface the operating system runs automatically.
What Vulkro detects
MAL-PERSIST-001 fires when a persistence-location token and a write or append token fall within a small window of source lines in the same file. Locations covered include an SSH key appended to ~/.ssh/authorized_keys, a cron entry (crontab -, /etc/cron.d, /etc/crontab, /var/spool/cron), a systemd unit or systemctl enable, a macOS LaunchAgent or LaunchDaemon plist and launchctl load, a shell rc append (~/.bashrc, ~/.zshrc, ~/.bash_profile, ~/.zprofile, ~/.profile), /etc/rc.local, and a Windows registry Run key or reg add.
A bare mention of a persistence path with no nearby write does not fire: an SSH management tool that merely reads ~/.ssh/config, or a path constant in documentation, is not persistence installation.
Write strength modulates confidence: a strong install primitive (an explicit >> append, Python open(.., 'a'), crontab -, reg add, systemctl enable, appendFile) grades High confidence, while a weaker write near the location (a bare echo, a generic .write() grades Medium. Severity stays High either way, because any write to a persistence surface is worth reading.
What this does not claim: co-location, not dataflow. It walks shell, JS, TS, Python, and PowerShell files, and never certifies code safe.
Remediation. Inspect the named surface on the machine (crontab -l, ls ~/.ssh/authorized_keys, systemctl list-unit-files, launchctl list) before and after any run, and remove entries you did not create. Software that needs to run at login should say so and ask, not write itself in during an install.
See also
- Confidence model - what
High,Medium, andLowmean for findings in this category. - Safety - what Vulkro does and does not access on your machine.
References
This page is generated by vulkro rules export <out-dir> from Vulkro's built-in detector catalogue. Edits made by hand are overwritten on the next regeneration.