About

Imported from mukul975/anthropic-cybersecurity-skills (skills/analyzing-persistence-mechanisms-in-linux/SKILL.md). Install upstream with npx skills add mukul975/anthropic-cybersecurity-skills --skill analyzing-persistence-mechanisms-in-linux. Copyright stays with the author (Apache-2.0).

Analyzing Persistence Mechanisms in Linux

Name: analyzing-persistence-mechanisms-in-linux
Author: mukul975

Overview

Adversaries establish persistence on Linux systems through crontab jobs, systemd service/timer units, LD_PRELOAD library injection, shell profile modifications (.bashrc, .profile), SSH authorized_keys backdoors, and init script manipulation. This skill scans for all known persistence vectors, checks file timestamps and integrity, and correlates findings with auditd logs to build a timeline of persistence installation.

When to Use

When investigating security incidents that require analyzing persistence mechanisms in linux
When building detection rules or threat hunting queries for this domain
When SOC analysts need structured procedures for this analysis type
When validating security monitoring coverage for related attack techniques

Prerequisites

Root or sudo access on target Linux system (or forensic image)
auditd configured with file watch rules on persistence paths
Python 3.8+ with standard library (os, subprocess, json)
Optional: OSSEC/Wazuh agent for file integrity monitoring alerts

Steps

Scan Crontab Entries — Enumerate all user crontabs, /etc/cron.d/, /etc/cron.daily/, and anacron jobs for suspicious commands
Audit Systemd Units — Check /etc/systemd/system/ and ~/.config/systemd/user/ for non-package-managed service and timer units
Detect LD_PRELOAD Hijacking — Check /etc/ld.so.preload and LD_PRELOAD environment variable for injected shared libraries
Inspect Shell Profiles — Scan .bashrc, .bash_profile, .profile, /etc/profile.d/ for injected commands or reverse shells
Check SSH Authorized Keys — Audit all authorized_keys files for unauthorized public keys with command restrictions
Correlate Auditd Logs — Search auditd logs for file modification events on persistence paths to build an installation timeline
Generate Persistence Report — Produce a risk-scored report of all discovered persistence mechanisms

Expected Output

JSON report of all persistence mechanisms found with risk scores
Timeline of persistence installation from auditd correlation
MITRE ATT&CK technique mapping (T1053, T1543, T1574, T1546)
Remediation commands for each detected persistence mechanism

Use it

Copy one of these into your project. Installing also returns the manifest and these snippets.

yaml

targets:
  - https://api.opensmartroute.ai/api/v1/registry/mukul975-anthropic-cybersecurity-skills-analyzing-persis-ce46c9/manifest   # or paste the manifest below

Manifest

An Open Capability Manifest: the router reads it to know what this does, what it costs and when to pick it.

mukul975-anthropic-cybersecurity-skills-analyzing-persis-ce46c9.ocm.jsonjson

{
  "ocm": "1",
  "id": "mukul975-anthropic-cybersecurity-skills-analyzing-persis-ce46c9",
  "kind": "skill",
  "name": "analyzing-persistence-mechanisms-in-linux",
  "description": "Scan Linux systems for persistence mechanisms including crontab/systemd entries, LD_PRELOAD injection, shell profile modifications (.bashrc, .profile), and SSH authorized_keys backdoors, then correlate findings with auditd logs into an installation timeline. Use during incident response or threat hunting to detect or confirm how an adversary maintained access to a compromised Linux host.",
  "publisher": "mukul975",
  "version": "1.0.0",
  "capabilities": {
    "domains": [
      "general"
    ],
    "tags": [
      "skill-md",
      "linux-persistence",
      "crontab",
      "systemd",
      "ld-preload",
      "auditd",
      "threat-hunting",
      "incident-response",
      "skills-sh"
    ],
    "languages": [
      "en"
    ]
  },
  "quality_prior": 0.6,
  "examples": [
    "Scan Linux systems for persistence mechanisms including crontab/systemd entries, LD_PRELOAD injection, shell profile modifications (.bashrc, .profile), and SSH authorized_keys backdoors, then correlate findings with auditd logs into an installation timeline. Use during incident response or threat hunting to detect or confirm how an adversary maintained access to a compromised Linux host."
  ],
  "primary": false,
  "metadata": {
    "source": {
      "provider": "skills.sh",
      "repository": "https://github.com/mukul975/anthropic-cybersecurity-skills",
      "path": "skills/analyzing-persistence-mechanisms-in-linux/SKILL.md",
      "ref": "HEAD",
      "url": "https://github.com/mukul975/anthropic-cybersecurity-skills/blob/HEAD/skills/analyzing-persistence-mechanisms-in-linux/SKILL.md",
      "key": "mukul975/anthropic-cybersecurity-skills/skills/analyzing-persistence-mechanisms-in-linux/SKILL.md"
    },
    "license": "Apache-2.0"
  },
  "instructions": "# Analyzing Persistence Mechanisms in Linux\n\n## Overview\n\nAdversaries establish persistence on Linux systems through crontab jobs, systemd service/timer units, LD_PRELOAD library injection, shell profile modifications (.bashrc, .profile), SSH authorized_keys backdoors, and init script manipulation. This skill scans for all known persistence vectors, checks file timestamps and integrity, and correlates findings with auditd logs to build a timeline of persistence installation.\n\n\n## When to Use\n\n- When investigating security incidents that require analyzing persistence mechanisms in linux\n- When ",
  "cost": {
    "context_tokens": 563
  }
}

Fetch it by URL: GET /api/v1/registry/mukul975-anthropic-cybersecurity-skills-analyzing-persis-ce46c9/manifest?version=1.0.0

Reviews

Star ratings from people who tried it. One review per account; edit yours any time.

No reviews yet. Install it, try it, and be the first to rate it.