Skill

analyzing-persistence-mechanisms-in-linux

From asi

Detects and analyzes Linux persistence mechanisms like crontab entries, systemd units, LD_PRELOAD hijacking, bashrc mods, and authorized_keys backdoors using auditd logs. For threat hunting and incident response.

Linux

Bash

Python

security

npx claudepluginhub plurigrid/asi --plugin asi

Tool Access

This skill uses the workspace's default tool permissions.

Preview

Adversaries establish persistence on Linux systems through crontab jobs, systemd service/timer units, LD_PRELOAD library injection, shell profile modifications (.bashrc, .profile), SSH authorized_keys backdoors, and init script manipulation. This skill scans for all known persistence vectors, checks file timestamps and integrity, and correlates findings with auditd logs to build a timeline of p...

SKILL.md

Similar Skills

analyzing-persistence-mechanisms-in-linux

5.9k

Detects and analyzes Linux persistence mechanisms like crontab entries, systemd units, LD_PRELOAD hijacking, bashrc mods, and authorized_keys backdoors using auditd logs for threat hunting.

3 files

cybersecurity-skills

analyzing-persistence-mechanisms-in-linux

Detects and analyzes Linux persistence mechanisms including crontab entries, systemd services, LD_PRELOAD hijacks, bashrc modifications, and authorized_keys backdoors using auditd and file integrity monitoring.

3 files

cybersecurity-skills-zh

performing-malware-persistence-investigation

Investigates malware persistence mechanisms on Windows and Linux systems using Autoruns, registry analysis, scheduled tasks, and Python scripts. For incident response, threat hunting, and remediation verification.

asi

Stats

Parent Repo Stars16

Parent Repo Forks5

Last CommitApr 4, 2026

Actions

View Source View Plugin View on GitHub View README

Help us improve

Share bugs, ideas, or general feedback.

Analyzing Persistence Mechanisms in Linux

Overview

When to Use

When investigating security incidents that require analyzing persistence mechanisms in linux
When building detection rules or threat hunting queries for this domain
When SOC analysts need structured procedures for this analysis type
When validating security monitoring coverage for related attack techniques

Prerequisites

Root or sudo access on target Linux system (or forensic image)
auditd configured with file watch rules on persistence paths
Python 3.8+ with standard library (os, subprocess, json)
Optional: OSSEC/Wazuh agent for file integrity monitoring alerts

Steps

Scan Crontab Entries — Enumerate all user crontabs, /etc/cron.d/, /etc/cron.daily/, and anacron jobs for suspicious commands
Audit Systemd Units — Check /etc/systemd/system/ and ~/.config/systemd/user/ for non-package-managed service and timer units
Detect LD_PRELOAD Hijacking — Check /etc/ld.so.preload and LD_PRELOAD environment variable for injected shared libraries
Inspect Shell Profiles — Scan .bashrc, .bash_profile, .profile, /etc/profile.d/ for injected commands or reverse shells
Check SSH Authorized Keys — Audit all authorized_keys files for unauthorized public keys with command restrictions
Correlate Auditd Logs — Search auditd logs for file modification events on persistence paths to build an installation timeline
Generate Persistence Report — Produce a risk-scored report of all discovered persistence mechanisms

Expected Output

JSON report of all persistence mechanisms found with risk scores
Timeline of persistence installation from auditd correlation
MITRE ATT&CK technique mapping (T1053, T1543, T1574, T1546)
Remediation commands for each detected persistence mechanism