Scan Linux systems for persistence mechanisms including crontab/systemd entries, LD_PRELOAD injection, shell profile modifications (.bashrc, .profile), and SSH authorized_keys backdoors, then correlate findings with auditd logs into an installation timeline. Use during incident response or threat hunting to detect or confirm how an adversary maintained access to a compromised Linux host.
Start a fresh conversation. Replace the highlighted placeholders.
Use analyzing-persistence-mechanisms-in-linux to examine [authorized Linux host or forensic image] with [root or sudo access] and auditd data, then produce a risk-scored persistence report and installation timeline.
Required inputs
[authorized Linux host or forensic image]
[root or sudo access]
User-approved starter prompt based on a pinned source version; check current skill requirements before running. Task evidence ↗
SKILL.md
name: analyzing-persistence-mechanisms-in-linuxdescription: Scan Linux systems for persistence mechanisms including crontab/systemd entries, LD_PRELOAD injection, shell profile modifications (.bashrc, .profile), and SSH authorized_keys backdoors, then correlate findings with auditd logs into an installation timeline. Use during incident response or threat hunting to detect or confirm how an adversary maintained access to a compromised Linux host.domain: cybersecuritysubdomain: threat-huntingtags: - linux-persistence- crontab- systemd- ld-preload- auditd- threat-hunting- incident-responsemitre_attack: - T1053.003- T1543.002- T1574.006- T1546.004- T1098.004version: '1.0'author: mahipallicense: Apache-2.0d3fend_techniques: - Executable Denylisting- Execution Isolation- File Metadata Consistency Validation- Process Termination- Content Format Conversionnist_csf: - DE.CM-01- DE.AE-02- DE.AE-07- ID.RA-05
Analyzing Persistence Mechanisms in Linux
Overview
Adversaries establish persistence on Linux systems through crontab jobs, systemd service/timer units, LD_PRELOAD library injection, shell profile modifications (.bashrc, .profile), SSH authorized_keys backdoors, and init script manipulation. This skill scans for all known persistence vectors, checks file timestamps and integrity, and correlates findings with auditd logs to build a timeline of persistence installation.
When to Use
When investigating security incidents that require analyzing persistence mechanisms in linux
When building detection rules or threat hunting queries for this domain
When SOC analysts need structured procedures for this analysis type
When validating security monitoring coverage for related attack techniques
Prerequisites
Root or sudo access on target Linux system (or forensic image)
auditd configured with file watch rules on persistence paths
Python 3.8+ with standard library (os, subprocess, json)
Optional: OSSEC/Wazuh agent for file integrity monitoring alerts
Steps
Scan Crontab Entries — Enumerate all user crontabs, /etc/cron.d/, /etc/cron.daily/, and anacron jobs for suspicious commands
Audit Systemd Units — Check /etc/systemd/system/ and ~/.config/systemd/user/ for non-package-managed service and timer units
Detect LD_PRELOAD Hijacking — Check /etc/ld.so.preload and LD_PRELOAD environment variable for injected shared libraries
Inspect Shell Profiles — Scan .bashrc, .bash_profile, .profile, /etc/profile.d/ for injected commands or reverse shells
Check SSH Authorized Keys — Audit all authorized_keys files for unauthorized public keys with command restrictions
Correlate Auditd Logs — Search auditd logs for file modification events on persistence paths to build an installation timeline
Generate Persistence Report — Produce a risk-scored report of all discovered persistence mechanisms
Expected Output
JSON report of all persistence mechanisms found with risk scores
Timeline of persistence installation from auditd correlation