Skip to main content
affpapa.org
RU EN
skill CX Codex

analyzing-persistence-mechanisms-in-linux — Claude Code skill

Scans Linux hosts for persistence in cron, systemd, LD_PRELOAD, and shell profiles, correlating findings with auditd logs.

Install into Claude Code · Skills CLI (Vercel) All methods and platforms ↓ 
npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill analyzing-persistence-mechanisms-in-linux -a claude-code
Open on GitHub

What analyzing-persistence-mechanisms-in-linux does

This skill audits Linux environments during incident response and threat hunting. It inspects user crontabs, /etc/cron.d/, systemd services and timers in /etc/systemd/system/, shared library injections in /etc/ld.so.preload, shell profiles like .bashrc, and unauthorized keys in authorized_keys.

Events correlate against auditd logs to reconstruct an installation timeline. The final result delivers a JSON report scored by risk, mapped to MITRE ATT&CK techniques (T1053, T1543, T1574, T1546), along with remediation commands for every discovered artifact.

Without root or sudo access, inspecting restricted system paths and other users' crontabs will fail. Prerequisites include Python 3.8+ using standard modules and auditd configured with file watch rules on target persistence locations.

What it helps with

  • audit user and system crontabs for unauthorized scheduled tasks
  • detect unmanaged systemd service and timer units
  • identify shared library injections via /etc/ld.so.preload
  • reconstruct persistence timeline from auditd file modification logs
  • generate remediation commands and MITRE ATT&CK technique mappings

Example prompts for the agent

  • Scan this Linux host for persistence mechanisms and correlate with auditd.
  • Check crontab, systemd units, and LD_PRELOAD for suspicious entries.
  • Generate a persistence analysis report with MITRE ATT&CK mappings and remediation steps.

How to install analyzing-persistence-mechanisms-in-linux

1Skills CLI (Vercel)

npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill analyzing-persistence-mechanisms-in-linux -a claude-code

2Manually: put the files in place

~/.claude/skills/analyzing-persistence-mechanisms-in-linux/SKILL.md

Copy the whole skill folder; for one project use .claude/skills/analyzing-persistence-mechanisms-in-linux/

Step by step, with commands for each platform: How to install skills in Claude Code: five ways

Questions about analyzing-persistence-mechanisms-in-linux

How to install analyzing-persistence-mechanisms-in-linux in Claude Code?

Run npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill analyzing-persistence-mechanisms-in-linux -a claude-code in your terminal.

What does analyzing-persistence-mechanisms-in-linux do?

It inspects persistence vectors on Linux hosts, including cron jobs, systemd units, preload injection, and SSH keys, mapping findings into a timeline using auditd logs.

What are the prerequisites for this skill?

You need root or sudo privileges, Python 3.8+ with standard libraries, and auditd configured with watch rules on critical persistence paths.

Source text

SKILL.md · Apache-2.0 
---
name: analyzing-persistence-mechanisms-in-linux
description: Scan Linux systems for persistence mechanisms including crontab/systemd entries, LD_PRELOAD injection, shell profile modifications (.bashrc, .profile), and SSH authorized_keys backdoors, then correlate findings with auditd logs into an installation timeline. Use during incident response or threat hunting to detect or confirm how an adversary maintained access to a compromised Linux host.
domain: cybersecurity
subdomain: threat-hunting
tags:
- linux-persistence
- crontab
- systemd
- ld-preload
- auditd
- threat-hunting
- incident-response
mitre_attack:
- T1053.003
- T1543.002
- T1574.006
- T1546.004
- T1098.004
version: '1.0'
author: mahipal
license: Apache-2.0
d3fend_techniques:
- Executable Denylisting
- Execution Isolation
- File Metadata Consistency Validation
- Process Termination
- Content Format Conversion
nist_csf:
- DE.CM-01
- DE.AE-02
- DE.AE-07
- ID.RA-05
---

# Analyzing Persistence Mechanisms in Linux

## Overview

Adversaries establish persistence on Linux systems through crontab jobs, systemd service/timer units, LD_PRELOAD library injection, shell profile modifications (.bashrc, .profile), SSH authorized_keys backdoors, and init script manipulation. This skill scans for all known persistence vectors, checks file timestamps and integrity, and correlates findings with auditd logs to build a timeline of persistence installation.


## When to Use

- When investigating security incidents that require analyzing persistence mechanisms in linux
- When building detection rules or threat hunting queries for this domain
- When SOC analysts need structured procedures for this analysis type
- When validating security monitoring coverage for related attack techniques

## Prerequisites

- Root or sudo access on target Linux system (or forensic image)
- auditd configured with file watch rules on persistence paths
- Python 3.8+ with standard library (os, subprocess, json)
- Optional: OSSEC/Wazuh agent for file integrity monitoring alerts

## Steps

1. **Scan Crontab Entries** — Enumerate all user crontabs, /etc/cron.d/, /etc/cron.daily/, and anacron jobs for suspicious commands
2. **Audit Systemd Units** — Check /etc/systemd/system/ and ~/.config/systemd/user/ for non-package-managed service and timer units
3. **Detect LD_PRELOAD Hijacking** — Check /etc/ld.so.preload and LD_PRELOAD environment variable for injected shared libraries
4. **Inspect Shell Profiles** — Scan .bashrc, .bash_profile, .profile, /etc/profile.d/ for injected commands or reverse shells
5. **Check SSH Authorized Keys** — Audit all authorized_keys files for unauthorized public keys with command restrictions
6. **Correlate Auditd Logs** — Search auditd logs for file modification events on persistence paths to build an installation timeline
7. **Generate Persistence Report** — Produce a risk-scored report of all discovered persistence mechanisms

## Expected Output

- JSON report of all persistence mechanisms found with risk scores
- Timeline of persistence installation from auditd correlation
- MITRE ATT&CK technique mapping (T1053, T1543, T1574, T1546)
- Remediation commands for each detected persistence mechanism

© mahipal · Apache-2.0 · mukul975/Anthropic-Cybersecurity-Skills

Similar skills

All skills for Security →
linux-hardening devops-skills A skill that walks your agent through CIS benchmarks: SSH config, user policy, firewall rules and kernel parameters. Useful when a server heads to production or an audit. CX Codex +1 769installs debian-linux-triage official github This skill troubleshoots Debian Linux issues with apt, systemd, and dpkg, while accounting for AppArmor and firewall concerns. Use it for guided diagnosis. 9,197installs fedora-linux-triage official github This skill troubleshoots Fedora with dnf, systemd, and SELinux-aware checks. Use it when an agent needs a clear diagnostic sequence and ready-to-run commands. 8,800installs yara-rule-authoring trailofbits Authors and reviews YARA-X detection rules for malware hunting, flagging strings that produce weak atoms and conditions that will fire on clean files. CX Codex +1 5,100installs huawei-cloud-obs-upload huaweicloud Uploads files and directories to Huawei Cloud OBS buckets, lists buckets with capacity and object count, and schedules recurring uploads through crontab. CX Codex +1 17,000installs secops-hunt official Google LLC secops-hunt supports proactive threat hunting in Google SecOps, from IoC lookups to UDM-based anomaly searches. Use it when testing a hunt hypothesis. CX Codex 1,900installs

From the same set90

bypassing-authentication-with-forced-browsing A pentest skill that enumerates URLs to find unprotected pages, APIs and admin panels, then checks where authentication isn't enforced. CX Codex +1 321installs testing-for-open-redirect-vulnerabilities Checks URL redirect parameters and validation bypasses. Use it when assessing login, OAuth, or SSO flows in systems you are authorized to test. CX Codex +1 318installs hardening-docker-containers-for-production This skill hardens Dockerfiles, images, and container runtime settings against CIS Docker Benchmark v1.8.0. Use it before production deployment or during an image audit. CX Codex +1 320installs conducting-external-reconnaissance-with-osint Builds a target profile from open sources: DNS, certificate logs, search, social media, repos and breach data. For the passive phase of a pentest. CX Codex +1 319installs analyzing-pdf-malware-with-pdfid Walks an agent through a suspicious PDF's structure to find embedded JavaScript, shellcode and exploits before anyone opens the file. CX Codex +1 317installs analyzing-threat-intelligence-feeds Turns commercial and open-source threat intel feeds into actionable indicators, adversary tactics and campaign context, normalized to STIX 2.1. CX Codex +1 316installs analyzing-threat-actor-ttps-with-mitre-attack Maps threat actor behavior and observed IOCs to MITRE ATT&CK, creates ATT&CK Navigator layers, and helps assess detection gaps. CX Codex +1 312installs testing-for-xxe-injection-vulnerabilities A skill that walks the agent through XXE checks: reading server files, SSRF and data exfiltration during authorized penetration tests. CX Codex +1 311installs

Project sponsors

Companies that keep this analytics open
Gold sponsor
Nutra.Club

Impressions, clicks and code copies — open statistics. We keep the numbers public for the same reason NeBlask itself is public. Become a sponsor