@phoenixx You might well have that in your list already, but I would include also /var/spool/cron (particularly /var/spool/cron/atjobs) in the list of directories to check for signs of persistence.
#Linux #IncidentResponse #BlueTeam #forensics #ITForensics #ComputerForensics #infosec #ThreatHunting