Analyzing Persistence Mechanisms
FreeScan Linux systems for hidden persistence threats.
Free · Opens the source repo
What Analyzing Persistence Mechanisms does
The Analyzing Persistence Mechanisms in Linux skill provides a comprehensive solution for security analysts and incident responders to identify and analyze persistence mechanisms employed by adversaries on Linux systems. This skill focuses on detecting various methods of maintaining unauthorized access, including crontab jobs, systemd services, LD_PRELOAD injections, and modifications to shell profiles. By utilizing this skill, users can systematically enumerate potential persistence vectors and assess their impact on system integrity.
The skill operates by scanning critical system files and directories for suspicious entries and configurations. It checks user crontabs, systemd units, and environment variables for signs of malicious activity. Additionally, it inspects shell profiles for unauthorized commands and SSH authorized_keys files for backdoors. After gathering this information, the skill correlates findings with auditd logs to construct a timeline of persistence installations, offering insights into how an adversary has maintained access.
This tool is particularly useful for security operations center (SOC) analysts, threat hunters, and incident response teams. It provides structured procedures for analyzing persistence mechanisms, which can enhance detection capabilities and improve incident response strategies. The output includes a detailed JSON report that highlights discovered persistence mechanisms, risk scores, and remediation commands, making it easier for analysts to take appropriate action.
By integrating this skill into your security toolkit, you can improve your ability to detect and respond to persistent threats on Linux systems, ensuring a more robust defense against potential breaches.
When to use it
Use this skill when investigating security incidents or conducting threat hunting focused on Linux environments.
When not to use it
This skill is not suitable for Windows environments or for general-purpose system monitoring outside of incident response and threat hunting.
What you can build with it
Incident Response Investigation
Use this skill during an incident response to identify how an attacker maintained access to a compromised Linux system.
Threat Hunting
Incorporate this skill into your threat hunting efforts to proactively search for persistence mechanisms on Linux hosts.
Security Monitoring Validation
Utilize the skill to validate your security monitoring coverage for persistence techniques and improve detection capabilities.
How to install Analyzing Persistence Mechanisms
View source1. Install with the skills CLI
npx skills add mukul975/anthropic-cybersecurity-skills/analyzing-persistence-mechanisms-in-linux --agent claude-code2. Or install it manually
Download the skill folder and drop it into ~/.claude/skills/ for all projects, or .claude/skills/ to scope it to one repo. Restart Claude Code so it picks up the new skill.
Anthropic's agentic coding CLI, and the reference implementation of Agent Skills. Drop a skill folder into ~/.claude/skills and Claude Code loads it automatically whenever a task matches the skill's description. Claude Code docs
Inside SKILL.md
Written by mukul975Analyzing Persistence Mechanisms in Linux
Overview
Adversaries establish persistence on Linux systems through crontab jobs, systemd service/timer units, LD_PRELOAD library injection, shell profile modifications (.bashrc, .profile), SSH authorized_keys backdoors, and init script manipulation. This skill scans for all known persistence vectors, checks file timestamps and integrity, and correlates findings with auditd logs to build a timeline of persistence installation.
When to Use
- When investigating security incidents that require analyzing persistence mechanisms in linux
- When building detection rules or threat hunting queries for this domain
- When SOC analysts need structured procedures for this analysis type
- When validating security monitoring coverage for related attack techniques
Prerequisites
- Root or sudo access on target Linux system (or forensic image)
- auditd configured with file watch rules on persistence paths
- Python 3.8+ with standard library (os, subprocess, json)
- Optional: OSSEC/Wazuh agent for file integrity monitoring alerts
Steps
- Scan Crontab Entries — Enumerate all user crontabs, /etc/cron.d/, /etc/cron.daily/, and anacron jobs for suspicious commands
- Audit Systemd Units — Check /etc/systemd/system/ and ~/.config/systemd/user/ for non-package-managed service and timer units
- Detect LD_PRELOAD Hijacking — Check /etc/ld.so.preload and LD_PRELOAD environment variable for injected shared libraries
- Inspect Shell Profiles — Scan .bashrc, .bash_profile, .profile, /etc/profile.d/ for injected commands or reverse shells
- Check SSH Authorized Keys — Audit all authorized_keys files for unauthorized public keys with command restrictions
- Correlate Auditd Logs — Search auditd logs for file modification events on persistence paths to build an installation timeline
- Generate Persistence Report — Produce a risk-scored report of all discovered persistence mechanisms
Expected Output
- JSON report of all persistence mechanisms found with risk scores
- Timeline of persistence installation from auditd correlation
- MITRE ATT&CK technique mapping (T1053, T1543, T1574, T1546)
- Remediation commands for each detected persistence mechanism
Frequently asked questions about Analyzing Persistence Mechanisms
Similar skills
Asset Criticality Scoring for Vulns
Prioritize vulnerabilities based on asset criticality.
Performing Alert Triage with Elastic SIEM
Streamline alert triage processes in Elastic Security.
Active Directory Vulnerability Assessment
Secure your Active Directory with comprehensive assessments.
Active Directory Investigation
Streamline your Active Directory compromise investigations.
Parsing Artifacts with Eric Zimmerman Tools
Efficiently parse Windows forensic artifacts for analysis.
Operationalizing MISP Threat Feeds
Enhance threat detection with curated MISP feeds.