security analyst security skill risk: medium
Linux Persistence Mechanisms Analyzer
The prompt outlines steps to scan crontab entries, audit systemd units, detect LD_PRELOAD hijacking, inspect shell profiles and SSH keys, correlate auditd logs, and generate a risk…
- Policy sensitive
- Human review
- External action: medium
SKILL 4 files · 2 folders
SKILL.md
--- name: analyzing-persistence-mechanisms-in-linux description: "Detect and analyze Linux persistence mechanisms including crontab entries, systemd service units, LD_PRELOAD" --- # Analyzing Persistence Mechanisms in Linux ## Overview Adversaries establish persistence on Linux systems through crontab jobs, systemd service/timer units, LD_PRELOAD library injection, shell profile modifications (.bashrc, .profile), SSH authorized_keys backdoors, and init script manipulation. This skill scans for all known persistence vectors, checks file timestamps and integrity, and correlates findings with auditd logs to build a timeline of persistence installation. ## When to Use - When investigating security incidents that require analyzing persistence mechanisms in linux - When building detection rules or threat hunting queries for this domain - When SOC analysts need structured procedures for this analysis type - When validating security monitoring coverage for related attack techniques ## Prerequisites - Root or sudo access on target Linux system (or forensic image) - auditd configured with file watch rules on persistence paths - Python 3.8+ with standard library (os, subprocess, json) - Optional: OSSEC/Wazuh agent for file integrity monitoring alerts ## Steps 1. **Scan Crontab Entries** — Enumerate all user crontabs, /etc/cron.d/, /etc/cron.daily/, and anacron jobs for suspicious commands 2. **Audit Systemd Units** — Check /etc/systemd/system/ and ~/.config/systemd/user/ for non-package-managed service and timer units 3. **Detect LD_PRELOAD Hijacking** — Check /etc/ld.so.preload and LD_PRELOAD environment variable for injected shared libraries 4. **Inspect Shell Profiles** — Scan .bashrc, .bash_profile, .profile, /etc/profile.d/ for injected commands or reverse shells 5. **Check SSH Authorized Keys** — Audit all authorized_keys files for unauthorized public keys with command restrictions 6. **Correlate Auditd Logs** — Search auditd logs for file modification events on persistence paths to build an installation timeline 7. **Generate Persistence Report** — Produce a risk-scored report of all discovered persistence mechanisms ## Expected Output - JSON report of all persistence mechanisms found with risk scores - Timeline of persistence installation from auditd correlation - MITRE ATT&CK technique mapping (T1053, T1543, T1574, T1546) - Remediation commands for each detected persistence mechanism
REQUIRED CONTEXT
- root or sudo access on target Linux system or forensic image
- auditd logs with file watch rules
OPTIONAL CONTEXT
- OSSEC/Wazuh alerts
- Python 3.8+ environment
EXPECTED OUTPUT
- Format
- json
- Schema
- json_report · persistence mechanisms with risk scores, installation timeline, MITRE ATT&CK technique mapping, remediation commands
- Constraints
-
- include risk scores
- include installation timeline from auditd
- include MITRE ATT&CK mappings
- include remediation commands
SUCCESS CRITERIA
- Scan for all known persistence vectors
- Check file timestamps and integrity
- Correlate findings with auditd logs
- Produce risk-scored report
CAVEATS
- Dependencies
-
- Root or sudo access on target Linux system (or forensic image)
- auditd configured with file watch rules on persistence paths
- Python 3.8+ with standard library (os, subprocess, json)
- Optional: OSSEC/Wazuh agent for file integrity monitoring alerts
QUALITY
- OVERALL
- 0.78
- CLARITY
- 0.90
- SPECIFICITY
- 0.85
- REUSABILITY
- 0.60
- COMPLETENESS
- 0.80
IMPROVEMENT SUGGESTIONS
- Add explicit placeholders (e.g., {{target_host}}, {{audit_log_path}}) to make the prompt reusable as a template.
USAGE
Copy the prompt above and paste it into your AI of choice — Claude, ChatGPT, Gemini, or anywhere else you're working. Replace any placeholder sections with your own context, then ask for the output.
MORE FOR SECURITY ANALYST
- Ransomware Network Indicators Analyzer security analyst security
- APT TTP Mapping with MITRE Navigator security analyst security
- Azure AD Lateral Movement KQL Detector security analyst security
- Kerberos Golden Ticket Forgery Detector security analyst security
- LOLBAS Abuse Detection with Sigma Rules security analyst security
- Shadow IT Cloud Usage Detector security analyst security
- Registry Run Key Persistence Detection Guide security analyst security
- Detect Risky OAuth Consent Grants in Entra ID security analyst security
- Windows Service Installation Threat Hunter security analyst security
- Web Server Log Intrusion Analyzer security analyst security
- RDP Brute Force Event Log Analyzer security analyst security
- Rekall Memory Forensics Artifact Extractor security analyst security
- Azure Activity Logs Threat Analyzer security analyst security
- Scapy Network Packet Analysis Guide security analyst security
- TLS Certificate Transparency Log Analyzer security analyst security
- Cobalt Strike Malleable C2 Profile Analyzer security analyst security
- Email Account Compromise Detection Procedures security analyst security
- Credential Stuffing Auth Log Analyzer security analyst security
- MISP Threat Intelligence Sharing with PyMISP security analyst security
- MISP Threat Landscape Analysis Guide security analyst security
- Malicious Scheduled Task Sysmon Detector security analyst security
- Kerberos Pass-the-Ticket Attack Detector security analyst security
- NTLM Relay Attack Event Log Analyzer security analyst security
- Linux Memory Forensics with LiME and Volatility security analyst security
- Insider Data Exfiltration DLP Analyzer security analyst security