Persistence and automatic execution
This category groups related risk explanations. A finding is a reason to review the activity and its context, not proof that a breach occurred.
Risk types
Section titled “Risk types”- Shell startup file access
A tool call refers to a recognized Unix shell startup or logout file.
- Git hook directory access
A tool call refers to a path under .git/hooks.
- Configuration write followed by execution (Requires Pro)
A session writes to a recognized automatic-execution or configuration location, then soon afterward runs a recognized command.
Event categories
Section titled “Event categories”These event category values map to this library category: persistence, persistence_sequence. Use the rule index to find the explanation for a specific rule ID.