Detects and analyzes Linux persistence mechanisms including crontab entries, systemd services, LD_PRELOAD hijacks, bashrc modifications, and authorized_keys backdoors using auditd and file integrity monitoring.
npx claudepluginhub killvxk/cybersecurity-skills-zhThis skill uses the workspace's default tool permissions.
攻击者通过 crontab 任务、systemd 服务/计时器单元、LD_PRELOAD 库注入、Shell 配置文件修改（.bashrc、.profile）、SSH authorized_keys 后门以及 init 脚本操控等方式在 Linux 系统上建立持久化（Persistence）。本技能扫描所有已知持久化向量，检查文件时间戳和完整性，并将发现结果与 auditd 日志关联，以构建持久化安装的时间线。
Detects and analyzes Linux persistence mechanisms like crontab entries, systemd units, LD_PRELOAD hijacking, bashrc mods, and authorized_keys backdoors using auditd logs. For threat hunting and incident response.
Detects and analyzes Linux persistence mechanisms like crontab entries, systemd units, LD_PRELOAD hijacking, bashrc mods, and authorized_keys backdoors using auditd logs for threat hunting.
Investigates malware persistence mechanisms on Windows and Linux systems by enumerating registry keys, services, autoruns, scheduled tasks, and rootkits for incident response, threat hunting, and forensics.
Share bugs, ideas, or general feedback.
攻击者通过 crontab 任务、systemd 服务/计时器单元、LD_PRELOAD 库注入、Shell 配置文件修改（.bashrc、.profile）、SSH authorized_keys 后门以及 init 脚本操控等方式在 Linux 系统上建立持久化（Persistence）。本技能扫描所有已知持久化向量，检查文件时间戳和完整性，并将发现结果与 auditd 日志关联，以构建持久化安装的时间线。