A nested SSH session occurs when a user connects to one host using ssh, then subsequently connects to another system from that host.
Nested SSH sessions can be discovered by observing the timing of packets within SSH sessions.
Linux Persistence: Startup Scripts
2024-11-10 DFIR CTF linux persistence systemd SysV init startup script
Linux Persistence: Cron
2024-11-10 DFIR CTF linux persistence cron
Linux Persistence: User Accounts
2021-06-27 DFIR linux persistence