analyzing-persistence-mechanisms-in-linux

Scan Linux systems for persistence mechanisms including crontab/systemd entries, LD_PRELOAD injection, shell profile modifications (.bashrc, .profil…

执行命令读凭据写文件严重 37 · 高危 4mukul975/Anthropic-Cybersecurity-Skills

它会碰到什么

扫了多少4 个文本文件，27 KB

它会碰到什么执行命令读凭据写文件

命中总数42 处

命中统计严重 37 · 高 4 · 中 1 · 低 0

逐条看命中（30 条严重或高危）

严重 references/api-reference.md:7persistence
```
crontab -l
```
严重 references/api-reference.md:10persistence
```
crontab -l -u username
```
严重 references/api-reference.md:60persistence
```
-w /etc/crontab -p wa -k cron_modification
```
严重 references/api-reference.md:74cred-paths
```
# Monitor authorized_keys
```
严重 references/api-reference.md:74cred-write
```
# Monitor authorized_keys
```

严重 references/api-reference.md:75cred-paths

-w /root/.ssh/authorized_keys -p wa -k ssh_key_modification

严重 references/api-reference.md:75cred-paths

-w /root/.ssh/authorized_keys -p wa -k ssh_key_modification

严重 references/api-reference.md:75cred-write

-w /root/.ssh/authorized_keys -p wa -k ssh_key_modification

严重 references/api-reference.md:85cred-paths
```
# Find all authorized_keys files
```
严重 references/api-reference.md:85cred-write
```
# Find all authorized_keys files
```

严重 references/api-reference.md:86cred-paths

find / -name authorized_keys -type f 2>/dev/null

严重 references/api-reference.md:86cred-write

find / -name authorized_keys -type f 2>/dev/null

严重 references/api-reference.md:89cred-paths

grep 'command=' /home/*/.ssh/authorized_keys /root/.ssh/authorized_keys 2>/dev/null

严重 references/api-reference.md:89cred-paths

grep 'command=' /home/*/.ssh/authorized_keys /root/.ssh/authorized_keys 2>/dev/null

严重 references/api-reference.md:89cred-paths

grep 'command=' /home/*/.ssh/authorized_keys /root/.ssh/authorized_keys 2>/dev/null

严重 references/api-reference.md:89cred-paths

grep 'command=' /home/*/.ssh/authorized_keys /root/.ssh/authorized_keys 2>/dev/null

严重 references/api-reference.md:89cred-write

grep 'command=' /home/*/.ssh/authorized_keys /root/.ssh/authorized_keys 2>/dev/null

严重 references/api-reference.md:89cred-write

grep 'command=' /home/*/.ssh/authorized_keys /root/.ssh/authorized_keys 2>/dev/null

严重 references/api-reference.md:100cred-paths

| Account Manipulation: SSH Keys | T1098.004 | authorized_keys |

严重 references/api-reference.md:100cred-write

| Account Manipulation: SSH Keys | T1098.004 | authorized_keys |

严重 scripts/agent.py:46persistence

["bash", "-c", "for u in $(cut -d: -f1 /etc/passwd); do crontab -l -u $u 2>/dev/null && echo \"__USER:$u\"; done"],

严重 scripts/agent.py:188cred-paths
```
def scan_ssh_authorized_keys():
```
严重 scripts/agent.py:188cred-write
```
def scan_ssh_authorized_keys():
```

严重 scripts/agent.py:189cred-paths

"""Audit SSH authorized_keys files for unauthorized entries."""

严重 scripts/agent.py:189cred-write

"""Audit SSH authorized_keys files for unauthorized entries."""

严重 scripts/agent.py:192cred-paths

auth_keys = os.path.join(home_dir, ".ssh", "authorized_keys")

严重 scripts/agent.py:192cred-paths

auth_keys = os.path.join(home_dir, ".ssh", "authorized_keys")

严重 scripts/agent.py:192cred-write

auth_keys = os.path.join(home_dir, ".ssh", "authorized_keys")

严重 scripts/agent.py:248cred-paths

ssh_keys = scan_ssh_authorized_keys() if "ssh" in scans else []

严重 scripts/agent.py:248cred-write

ssh_keys = scan_ssh_authorized_keys() if "ssh" in scans else []

这一栏是扫描器报的事实，不是结论。命中多不等于有毒（安全工具、规则库、示例脚本本来就会包含危险写法），命中少也不等于干净。它和你手上的凭据、文件、网络有什么关系，需要你自己看。

技能内容

Analyzing Persistence Mechanisms in Linux

Overview

Adversaries establish persistence on Linux systems through crontab jobs, systemd service/timer units, LD_PRELOAD library injection, shell profile modifications (.bashrc, .profile), SSH authorized_keys backdoors, and init script manipulation. This skill scans for all known persistence vectors, checks file timestamps and integrity, and correlates findings with auditd logs to build a timeline of persistence installation.

When to Use

When investigating security incidents that require analyzing persistence mechanisms in linux
When building detection rules or threat hunting queries for this domain
When SOC analysts need structured procedures for this analysis type
When validating security monitoring coverage for related attack techniques

Prerequisites

Root or sudo access on target Linux system (or forensic image)
auditd configured with file watch rules on persistence paths
Python 3.8+ with standard library (os, subprocess, json)
Optional: OSSEC/Wazuh agent for file integrity monitoring alerts

Steps

Scan Crontab Entries — Enumerate all user crontabs, /etc/cron.d/, /etc/cron.daily/, and anacron jobs for suspicious commands
Audit Systemd Units — Check /etc/systemd/system/ and ~/.config/systemd/user/ for non-package-managed service and timer units
Detect LD_PRELOAD Hijacking — Check /etc/ld.so.preload and LD_PRELOAD environment variable for injected shared libraries
Inspect Shell Profiles — Scan .bashrc, .bash_profile, .profile, /etc/profile.d/ for injected commands or reverse shells
Check SSH Authorized Keys — Audit all authorized_keys files for unauthorized public keys with command restrictions
Correlate Auditd Logs — Search auditd logs for file modification events on persistence paths to build an installation timeline
Generate Persistence Report — Produce a risk-scored report of all discovered persistence mechanisms

Expected Output

JSON report of all persistence mechanisms found with risk scores
Timeline of persistence installation from auditd correlation
MITRE ATT&CK technique mapping (T1053, T1543, T1574, T1546)
Remediation commands for each detected persistence mechanism

想直接用这个技能？

本站把开放许可（MIT / Apache 等）的技能按仓库打包整理到网盘，点一下转存到你自己的网盘，不用一个个从 GitHub 拉。许可未声明的技能只给原始仓库链接，不打包。

去原始仓库

它属于哪个仓库

仓库mukul975/Anthropic-Cybersecurity-Skills

星标★ 32,865

本站分层T1

该仓技能数818

原文件路径skills/analyzing-persistence-mechanisms-in-linux/SKILL.md

同一个仓库里的其他技能

看这个仓库的全部 818 个技能