Cron persistence
Named by 2 kept items in this workspace.
Search every workspace for Cron persistence. It matches the name as written, so it can find other things that share it.
The items that name it 2
Hidden entries /etc/cron.d/.s, .sys-health and .syscheck, plus watchdog re-downloading every 30 seconds
Actor A used simple @reboot crontab; Actor B used cron persistence (30 3,15 * * *) running installsh and dnser twice daily; Actor C used /etc/cron.d/auto-upgrade disguised as system updates executing daily at midnight
All techniques in this workspace.