AI Agent Supply Chain: DNS TXT Reverse Shell and Persistence via Setup Script

Ibrahim Saud@tektrix

•updated Jun 29, 2026•1•0•11

Detects suspicious command-line patterns on Linux systems commonly associated with post-exploitation activity, including the establishment of reverse shells, encoded payload delivery via DNS, and manual modifications to crontab or SSH authorized_keys for persistence.