The file it leaves behind

Twenty-two break-ins wrote the same hidden file. Nothing ever read it back.

After a compromise the useful question is narrow. Not what could have happened, but whether this particular thing touched this particular machine.

Twenty-two sessions here wrote a hidden file into the temporary directory. Inside it, one of four passwords: one two three four five six seven eight, the shorter version, a capitalised variant, and the word password.

Now the honest part. In those same sessions, no account password was changed. And nothing ever read the file back.

So what it is for is unclear. What it is, is consistent.

That is what an indicator is. Not proof of intent, just something that turns up reliably when a particular tool has been on the machine, and one search answers it.

Search for the marker. Consistency is what makes one useful.