analyzing-persistence-mechanisms-in-linux
Detect and analyze Linux persistence mechanisms including crontab entries, systemd service units, LD_PRELOAD hijacking, bashrc modifications, and authorized_keys backdoors using auditd and file integrity monitoring
Best use case
analyzing-persistence-mechanisms-in-linux is best used when you need a repeatable AI agent workflow instead of a one-off prompt.
Detect and analyze Linux persistence mechanisms including crontab entries, systemd service units, LD_PRELOAD hijacking, bashrc modifications, and authorized_keys backdoors using auditd and file integrity monitoring
Teams using analyzing-persistence-mechanisms-in-linux should expect a more consistent output, faster repeated execution, less prompt rewriting.
When to use this skill
- You want a reusable workflow that can be run more than once with consistent structure.
When not to use this skill
- You only need a quick one-off answer and do not need a reusable workflow.
- You cannot install or maintain the underlying files, dependencies, or repository context.
Installation
Claude Code / Cursor / Codex
Manual Installation
- Download SKILL.md from GitHub
- Place it in
.claude/skills/analyzing-persistence-mechanisms-in-linux/SKILL.mdinside your project - Restart your AI agent — it will auto-discover the skill
How analyzing-persistence-mechanisms-in-linux Compares
| Feature / Agent | analyzing-persistence-mechanisms-in-linux | Standard Approach |
|---|---|---|
| Platform Support | Not specified | Limited / Varies |
| Context Awareness | High | Baseline |
| Installation Complexity | Unknown | N/A |
Frequently Asked Questions
What does this skill do?
Detect and analyze Linux persistence mechanisms including crontab entries, systemd service units, LD_PRELOAD hijacking, bashrc modifications, and authorized_keys backdoors using auditd and file integrity monitoring
Where can I find the source code?
You can find the source code on GitHub using the link provided at the top of the page.
SKILL.md Source
# Analyzing Persistence Mechanisms in Linux ## Overview Adversaries establish persistence on Linux systems through crontab jobs, systemd service/timer units, LD_PRELOAD library injection, shell profile modifications (.bashrc, .profile), SSH authorized_keys backdoors, and init script manipulation. This skill scans for all known persistence vectors, checks file timestamps and integrity, and correlates findings with auditd logs to build a timeline of persistence installation. ## When to Use - When investigating security incidents that require analyzing persistence mechanisms in linux - When building detection rules or threat hunting queries for this domain - When SOC analysts need structured procedures for this analysis type - When validating security monitoring coverage for related attack techniques ## Prerequisites - Root or sudo access on target Linux system (or forensic image) - auditd configured with file watch rules on persistence paths - Python 3.8+ with standard library (os, subprocess, json) - Optional: OSSEC/Wazuh agent for file integrity monitoring alerts ## Steps 1. **Scan Crontab Entries** — Enumerate all user crontabs, /etc/cron.d/, /etc/cron.daily/, and anacron jobs for suspicious commands 2. **Audit Systemd Units** — Check /etc/systemd/system/ and ~/.config/systemd/user/ for non-package-managed service and timer units 3. **Detect LD_PRELOAD Hijacking** — Check /etc/ld.so.preload and LD_PRELOAD environment variable for injected shared libraries 4. **Inspect Shell Profiles** — Scan .bashrc, .bash_profile, .profile, /etc/profile.d/ for injected commands or reverse shells 5. **Check SSH Authorized Keys** — Audit all authorized_keys files for unauthorized public keys with command restrictions 6. **Correlate Auditd Logs** — Search auditd logs for file modification events on persistence paths to build an installation timeline 7. **Generate Persistence Report** — Produce a risk-scored report of all discovered persistence mechanisms ## Expected Output - JSON report of all persistence mechanisms found with risk scores - Timeline of persistence installation from auditd correlation - MITRE ATT&CK technique mapping (T1053, T1543, T1574, T1546) - Remediation commands for each detected persistence mechanism