How do I install the Analyzing Persistence Mechanisms In Linux skill?

Run npx skillmds@latest add gabrielmoreira/analyzing-persistence-mechanisms-in-linux in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Analyzing Persistence Mechanisms In Linux safe to use?

This skill has not completed SkillMD's automated safety review yet. Independent scanners report: SkillSpector: CAUTION, Skill Scanner: PASS. Capability flags: docs only, executes scripts. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Analyzing Persistence Mechanisms In Linux?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Analyzing Persistence Mechanisms In Linux free to use?

Yes. Installing skills from SkillMD is free. This skill is licensed under Apache-2.

Who published Analyzing Persistence Mechanisms In Linux?

gabrielmoreira (@gabrielmoreira) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Analyzing Persistence Mechanisms In Linux by gabrielmoreira

Name: Analyzing Persistence Mechanisms In Linux
Rating: 4.5 (4 reviews)
Author: gabrielmoreira

Analyzing Persistence Mechanisms In Linux

Scan Linux systems for persistence mechanisms including crontab/systemd entries, LD_PRELOAD injection, shell profile modifications (.bashrc, .profile), and SSH authorized_keys backdoors, then correlate findings with auditd logs into an installation timeline. Use during incident response or threat hunting to detect or confirm how an adversary maintained access to a compromised Linux host.

gabrielmoreira Updated Sep 9, 2026 17 repo stars

File contents

Analyzing Persistence Mechanisms in Linux

Overview

Adversaries establish persistence on Linux systems through crontab jobs, systemd service/timer units, LD_PRELOAD library injection, shell profile modifications (.bashrc, .profile), SSH authorized_keys backdoors, and init script manipulation. This skill scans for all known persistence vectors, checks file timestamps and integrity, and correlates findings with auditd logs to build a timeline of persistence installation.

When to Use

When investigating security incidents that require analyzing persistence mechanisms in linux
When building detection rules or threat hunting queries for this domain
When SOC analysts need structured procedures for this analysis type
When validating security monitoring coverage for related attack techniques

Prerequisites

Root or sudo access on target Linux system (or forensic image)
auditd configured with file watch rules on persistence paths
Python 3.8+ with standard library (os, subprocess, json)
Optional: OSSEC/Wazuh agent for file integrity monitoring alerts

Steps

Scan Crontab Entries — Enumerate all user crontabs, /etc/cron.d/, /etc/cron.daily/, and anacron jobs for suspicious commands
Audit Systemd Units — Check /etc/systemd/system/ and ~/.config/systemd/user/ for non-package-managed service and timer units
Detect LD_PRELOAD Hijacking — Check /etc/ld.so.preload and LD_PRELOAD environment variable for injected shared libraries
Inspect Shell Profiles — Scan .bashrc, .bash_profile, .profile, /etc/profile.d/ for injected commands or reverse shells
Check SSH Authorized Keys — Audit all authorized_keys files for unauthorized public keys with command restrictions
Correlate Auditd Logs — Search auditd logs for file modification events on persistence paths to build an installation timeline
Generate Persistence Report — Produce a risk-scored report of all discovered persistence mechanisms

Expected Output

JSON report of all persistence mechanisms found with risk scores
Timeline of persistence installation from auditd correlation
MITRE ATT&CK technique mapping (T1053, T1543, T1574, T1546)
Remediation commands for each detected persistence mechanism

---name: analyzing-persistence-mechanisms-in-linuxdescription: Scan Linux systems for persistence mechanisms including crontab/systemd entries, LD_PRELOAD injection, shell profile modifications (.bashrc, .profile), and SSH authorized_keys backdoors, then correlate findings with auditd logs into an installation timeline. Use during incident response or threat hunting to detect or confirm how an adversary maintained access to a compromised Linux host.license: Apache-2.0--- # Analyzing Persistence Mechanisms in Linux ## Overview Adversaries establish persistence on Linux systems through crontab jobs, systemd service/timer units, LD_PRELOAD library injection, shell profile modifications (.bashrc, .profile), SSH authorized_keys backdoors, and init script manipulation. This skill scans for all known persistence vectors, checks file timestamps and integrity, and correlates findings with auditd logs to build a timeline of persistence installation. ## When to Use - When investigating security incidents that require analyzing persistence mechanisms in linux - When building detection rules or threat hunting queries for this domain - When SOC analysts need structured procedures for this analysis type - When validating security monitoring coverage for related attack techniques ## Prerequisites - Root or sudo access on target Linux system (or forensic image) - auditd configured with file watch rules on persistence paths - Python 3.8+ with standard library (os, subprocess, json) - Optional: OSSEC/Wazuh agent for file integrity monitoring alerts ## Steps 1. **Scan Crontab Entries** — Enumerate all user crontabs, /etc/cron.d/, /etc/cron.daily/, and anacron jobs for suspicious commands 2. **Audit Systemd Units** — Check /etc/systemd/system/ and ~/.config/systemd/user/ for non-package-managed service and timer units 3. **Detect LD_PRELOAD Hijacking** — Check /etc/ld.so.preload and LD_PRELOAD environment variable for injected shared libraries 4. **Inspect Shell Profiles** — Scan .bashrc, .bash_profile, .profile, /etc/profile.d/ for injected commands or reverse shells 5. **Check SSH Authorized Keys** — Audit all authorized_keys files for unauthorized public keys with command restrictions 6. **Correlate Auditd Logs** — Search auditd logs for file modification events on persistence paths to build an installation timeline 7. **Generate Persistence Report** — Produce a risk-scored report of all discovered persistence mechanisms ## Expected Output - JSON report of all persistence mechanisms found with risk scores - Timeline of persistence installation from auditd correlation - MITRE ATT&CK technique mapping (T1053, T1543, T1574, T1546) - Remediation commands for each detected persistence mechanism

Frequently asked questions