Hunting for Persistence in Linux (Part 1): Auditd, Sysmon, Osquery (and Webshells)