YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]
High
- Category
- YARA Match
- Confidence
- 75% confidence
- Finding
YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
- Content
md P: `bundle_schedule_hint`) → returns a `cronLine` plus the exact non-interactive command. **It writes nothing.** 3. Paste the `cronLine` into `crontab -e`, e.g. `0 2 * * 1 compliance-aiops bundle generate soc2 --period 7d --sign` 4. Export `COMPLIANCE_AIOPS_MASTER_PASSWORD` in the cron environment so the signing key unlocks non-interactively — never inline the real password in the crontab 5. After the first scheduled run, `compliance-aiops bundle list` and `bundle verify` the newest bundle to confirm the unattended path really works 6. **Failure branch**: if the cron run produces no bundle, the usual causes are an unset master password (signing cannot unlock) or `COMPLIANCE_AIOPS_HOME` not being set in cron's environment, so sources resolve elsewhere. Verify by running the emitted command by hand with a clean environment before trusting the schedule. ## Governance & Safety The skill reads audit trails and writes evidence bundles and records what it does