WGM Associates interview question

How would you find persistence on a compromised device?