[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6ESMQ5MVA852CDWPRRCN69N":3,"skill-same:01M6ESMQ5MVA852CDWPRRCN69N":102},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":63,"commitSha":64,"skillDirectory":65,"forksCount":14,"repositoryHtmlUrl":66,"repositoryHomepageUrl":67,"ownerHtmlUrl":68,"ownerBlogUrl":6,"ownerDescription":69,"updatedAt":70,"install":71,"resources":84},"01M6ESMQ5MVA852CDWPRRCN69N","analyzing-linux-system-artifacts",null,"Examine Linux system artifacts including auth logs, cron jobs, shell history, and system configuration to uncover evidence of compromise or unauthorized activity.","henriquescastilho\u002Fmy-claude","henriquescastilho","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F153296945?v=4","01M6ESH7EXPXTH9CVQ4K16SRG8","Henrique Scheer","01M6ESH7JHEK2PTNNH4HEH787Z",0,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fanalyzing-linux-system-artifacts\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"linux","artifacts","system","analyzing linux system artifacts","analyzing","activity","de","incident","log","cron","analysis","digital-forensics","incident-investigation","persistence-detection","log-analysis","system-artifacts","linux-forensics","logs","auth","cybersecurity","2026-11-10 10:12:30",false,"---\nname: analyzing-linux-system-artifacts\ndescription: Examine Linux system artifacts including auth logs, cron jobs, shell\n  history, and system configuration to uncover evidence of compromise or unauthorized\n  activity.\ndomain: cybersecurity\nsubdomain: digital-forensics\ntags:\n- forensics\n- linux-forensics\n- system-artifacts\n- log-analysis\n- persistence-detection\n- incident-investigation\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- RS.AN-01\n- RS.AN-03\n- DE.AE-02\n- RS.MA-01\nmitre_attack:\n- T1070\n- T1059.004\n- T1543.002\n- T1053.003\n---\n\n# Analyzing Linux System Artifacts\n\n## When to Use\n- When investigating a compromised Linux server or workstation\n- For identifying persistence mechanisms (cron, systemd, SSH keys)\n- When tracing user activity through shell history and authentication logs\n- During incident response to determine the scope of a Linux-based breach\n- For detecting rootkits, backdoors, and unauthorized modifications\n\n## Prerequisites\n- Forensic image or live access to the Linux system (read-only)\n- Understanding of Linux file system hierarchy (FHS)\n- Knowledge of common Linux logging locations (\u002Fvar\u002Flog\u002F)\n- Tools: chkrootkit, rkhunter, AIDE, auditd logs\n- Familiarity with systemd, cron, and PAM configurations\n- Root access for complete artifact collection\n\n## Workflow\n\n### Step 1: Mount and Collect System Artifacts\n\n```bash\n# Mount forensic image read-only\nmount -o ro,loop,offset=$((2048*512)) \u002Fcases\u002Fcase-2024-001\u002Fimages\u002Flinux_evidence.dd \u002Fmnt\u002Fevidence\n\n# Create collection directories\nmkdir -p \u002Fcases\u002Fcase-2024-001\u002Flinux\u002F{logs,config,users,persistence,network}\n\n# Collect authentication logs\ncp \u002Fmnt\u002Fevidence\u002Fvar\u002Flog\u002Fauth.log* \u002Fcases\u002Fcase-2024-001\u002Flinux\u002Flogs\u002F\ncp \u002Fmnt\u002Fevidence\u002Fvar\u002Flog\u002Fsecure* \u002Fcases\u002Fcase-2024-001\u002Flinux\u002Flogs\u002F\ncp \u002Fmnt\u002Fevidence\u002Fvar\u002Flog\u002Fsyslog* \u002Fcases\u002Fcase-2024-001\u002Flinux\u002Flogs\u002F\ncp \u002Fmnt\u002Fevidence\u002Fvar\u002Flog\u002Fkern.log* \u002Fcases\u002Fcase-2024-001\u002Flinux\u002Flogs\u002F\ncp \u002Fmnt\u002Fevidence\u002Fvar\u002Flog\u002Faudit\u002Faudit.log* \u002Fcases\u002Fcase-2024-001\u002Flinux\u002Flogs\u002F\ncp \u002Fmnt\u002Fevidence\u002Fvar\u002Flog\u002Fwtmp \u002Fcases\u002Fcase-2024-001\u002Flinux\u002Flogs\u002F\ncp \u002Fmnt\u002Fevidence\u002Fvar\u002Flog\u002Fbtmp \u002Fcases\u002Fcase-2024-001\u002Flinux\u002Flogs\u002F\ncp \u002Fmnt\u002Fevidence\u002Fvar\u002Flog\u002Flastlog \u002Fcases\u002Fcase-2024-001\u002Flinux\u002Flogs\u002F\ncp \u002Fmnt\u002Fevidence\u002Fvar\u002Flog\u002Ffaillog \u002Fcases\u002Fcase-2024-001\u002Flinux\u002Flogs\u002F\n\n# Collect user artifacts\nfor user_dir in \u002Fmnt\u002Fevidence\u002Fhome\u002F*\u002F; do\n    username=$(basename \"$user_dir\")\n    mkdir -p \u002Fcases\u002Fcase-2024-001\u002Flinux\u002Fusers\u002F$username\n    cp \"$user_dir\"\u002F.bash_history \u002Fcases\u002Fcase-2024-001\u002Flinux\u002Fusers\u002F$username\u002F 2>\u002Fdev\u002Fnull\n    cp \"$user_dir\"\u002F.zsh_history \u002Fcases\u002Fcase-2024-001\u002Flinux\u002Fusers\u002F$username\u002F 2>\u002Fdev\u002Fnull\n    cp -r \"$user_dir\"\u002F.ssh\u002F \u002Fcases\u002Fcase-2024-001\u002Flinux\u002Fusers\u002F$username\u002F 2>\u002Fdev\u002Fnull\n    cp \"$user_dir\"\u002F.bashrc \u002Fcases\u002Fcase-2024-001\u002Flinux\u002Fusers\u002F$username\u002F 2>\u002Fdev\u002Fnull\n    cp \"$user_dir\"\u002F.profile \u002Fcases\u002Fcase-2024-001\u002Flinux\u002Fusers\u002F$username\u002F 2>\u002Fdev\u002Fnull\n    cp \"$user_dir\"\u002F.viminfo \u002Fcases\u002Fcase-2024-001\u002Flinux\u002Fusers\u002F$username\u002F 2>\u002Fdev\u002Fnull\n    cp \"$user_dir\"\u002F.wget-hsts \u002Fcases\u002Fcase-2024-001\u002Flinux\u002Fusers\u002F$username\u002F 2>\u002Fdev\u002Fnull\n    cp \"$user_dir\"\u002F.python_history \u002Fcases\u002Fcase-2024-001\u002Flinux\u002Fusers\u002F$username\u002F 2>\u002Fdev\u002Fnull\ndone\n\n# Collect root user artifacts\ncp \u002Fmnt\u002Fevidence\u002Froot\u002F.bash_history \u002Fcases\u002Fcase-2024-001\u002Flinux\u002Fusers\u002Froot\u002F 2>\u002Fdev\u002Fnull\ncp -r \u002Fmnt\u002Fevidence\u002Froot\u002F.ssh\u002F \u002Fcases\u002Fcase-2024-001\u002Flinux\u002Fusers\u002Froot\u002F 2>\u002Fdev\u002Fnull\n\n# Collect system configuration\ncp \u002Fmnt\u002Fevidence\u002Fetc\u002Fpasswd \u002Fcases\u002Fcase-2024-001\u002Flinux\u002Fconfig\u002F\ncp \u002Fmnt\u002Fevidence\u002Fetc\u002Fshadow \u002Fcases\u002Fcase-2024-001\u002Flinux\u002Fconfig\u002F\ncp \u002Fmnt\u002Fevidence\u002Fetc\u002Fgroup \u002Fcases\u002Fcase-2024-001\u002Flinux\u002Fconfig\u002F\ncp \u002Fmnt\u002Fevidence\u002Fetc\u002Fsudoers \u002Fcases\u002Fcase-2024-001\u002Flinux\u002Fconfig\u002F\ncp -r \u002Fmnt\u002Fevidence\u002Fetc\u002Fsudoers.d\u002F \u002Fcases\u002Fcase-2024-001\u002Flinux\u002Fconfig\u002F\ncp \u002Fmnt\u002Fevidence\u002Fetc\u002Fhosts \u002Fcases\u002Fcase-2024-001\u002Flinux\u002Fconfig\u002F\ncp \u002Fmnt\u002Fevidence\u002Fetc\u002Fresolv.conf \u002Fcases\u002Fcase-2024-001\u002Flinux\u002Fconfig\u002F\ncp -r \u002Fmnt\u002Fevidence\u002Fetc\u002Fssh\u002F \u002Fcases\u002Fcase-2024-001\u002Flinux\u002Fconfig\u002F\n```\n\n### Step 2: Analyze User Accounts and Authentication\n\n```bash\n# Analyze user accounts for anomalies\npython3 \u003C\u003C 'PYEOF'\nprint(\"=== USER ACCOUNT ANALYSIS ===\\n\")\n\n# Parse \u002Fetc\u002Fpasswd\nwith open('\u002Fcases\u002Fcase-2024-001\u002Flinux\u002Fconfig\u002Fpasswd') as f:\n    for line in f:\n        parts = line.strip().split(':')\n        if len(parts) >= 7:\n            username, _, uid, gid, comment, home, shell = parts[0], parts[1], int(parts[2]), int(parts[3]), parts[4], parts[5], parts[6]\n\n            # Flag accounts with UID 0 (root equivalent)\n            if uid == 0 and username != 'root':\n                print(f\"  ALERT: UID 0 account: {username} (shell: {shell})\")\n\n            # Flag accounts with login shells that shouldn't have them\n            if shell not in ('\u002Fbin\u002Ffalse', '\u002Fusr\u002Fsbin\u002Fnologin', '\u002Fbin\u002Fsync') and uid >= 1000:\n                print(f\"  User: {username} (UID:{uid}, Shell:{shell}, Home:{home})\")\n\n            # Flag system accounts with login shells\n            if uid \u003C 1000 and uid > 0 and shell in ('\u002Fbin\u002Fbash', '\u002Fbin\u002Fsh', '\u002Fbin\u002Fzsh'):\n                print(f\"  WARNING: System account with shell: {username} (UID:{uid}, Shell:{shell})\")\n\n# Parse \u002Fetc\u002Fshadow for account status\nprint(\"\\n=== PASSWORD STATUS ===\")\nwith open('\u002Fcases\u002Fcase-2024-001\u002Flinux\u002Fconfig\u002Fshadow') as f:\n    for line in f:\n        parts = line.strip().split(':')\n        if len(parts) >= 3:\n            username = parts[0]\n            pwd_hash = parts[1]\n            last_change = parts[2]\n\n            if pwd_hash and pwd_hash not in ('*', '!', '!!', ''):\n                hash_type = 'Unknown'\n                if pwd_hash.startswith('$6$'): hash_type = 'SHA-512'\n                elif pwd_hash.startswith('$5$'): hash_type = 'SHA-256'\n                elif pwd_hash.startswith('$y$'): hash_type = 'yescrypt'\n                elif pwd_hash.startswith('$1$'): hash_type = 'MD5 (WEAK)'\n                print(f\"  {username}: {hash_type} hash, last changed: day {last_change}\")\nPYEOF\n\n# Analyze login history\nlast -f \u002Fcases\u002Fcase-2024-001\u002Flinux\u002Flogs\u002Fwtmp > \u002Fcases\u002Fcase-2024-001\u002Flinux\u002Fanalysis\u002Flogin_history.txt\nlastb -f \u002Fcases\u002Fcase-2024-001\u002Flinux\u002Flogs\u002Fbtmp > \u002Fcases\u002Fcase-2024-001\u002Flinux\u002Fanalysis\u002Ffailed_logins.txt 2>\u002Fdev\u002Fnull\n```\n\n### Step 3: Examine Persistence Mechanisms\n\n```bash\n# Check cron jobs for all users\necho \"=== CRON JOBS ===\" > \u002Fcases\u002Fcase-2024-001\u002Flinux\u002Fpersistence\u002Fcron_analysis.txt\n\n# System cron\nfor cronfile in \u002Fmnt\u002Fevidence\u002Fetc\u002Fcrontab \u002Fmnt\u002Fevidence\u002Fetc\u002Fcron.d\u002F*; do\n    echo \"--- $cronfile ---\" >> \u002Fcases\u002Fcase-2024-001\u002Flinux\u002Fpersistence\u002Fcron_analysis.txt\n    cat \"$cronfile\" 2>\u002Fdev\u002Fnull >> \u002Fcases\u002Fcase-2024-001\u002Flinux\u002Fpersistence\u002Fcron_analysis.txt\n    echo \"\" >> \u002Fcases\u002Fcase-2024-001\u002Flinux\u002Fpersistence\u002Fcron_analysis.txt\ndone\n\n# User cron tabs\nfor cronfile in \u002Fmnt\u002Fevidence\u002Fvar\u002Fspool\u002Fcron\u002Fcrontabs\u002F*; do\n    echo \"--- User crontab: $(basename $cronfile) ---\" >> \u002Fcases\u002Fcase-2024-001\u002Flinux\u002Fpersistence\u002Fcron_analysis.txt\n    cat \"$cronfile\" 2>\u002Fdev\u002Fnull >> \u002Fcases\u002Fcase-2024-001\u002Flinux\u002Fpersistence\u002Fcron_analysis.txt\n    echo \"\" >> \u002Fcases\u002Fcase-2024-001\u002Flinux\u002Fpersistence\u002Fcron_analysis.txt\ndone\n\n# Check systemd services for persistence\necho \"=== SYSTEMD SERVICES ===\" > \u002Fcases\u002Fcase-2024-001\u002Flinux\u002Fpersistence\u002Fsystemd_analysis.txt\nfind \u002Fmnt\u002Fevidence\u002Fetc\u002Fsystemd\u002Fsystem\u002F -name \"*.service\" -newer \u002Fmnt\u002Fevidence\u002Fetc\u002Fos-release \\\n   >> \u002Fcases\u002Fcase-2024-001\u002Flinux\u002Fpersistence\u002Fsystemd_analysis.txt\n\nfor svc in \u002Fmnt\u002Fevidence\u002Fetc\u002Fsystemd\u002Fsystem\u002F*.service; do\n    echo \"--- $(basename $svc) ---\" >> \u002Fcases\u002Fcase-2024-001\u002Flinux\u002Fpersistence\u002Fsystemd_analysis.txt\n    cat \"$svc\" >> \u002Fcases\u002Fcase-2024-001\u002Flinux\u002Fpersistence\u002Fsystemd_analysis.txt\n    echo \"\" >> \u002Fcases\u002Fcase-2024-001\u002Flinux\u002Fpersistence\u002Fsystemd_analysis.txt\ndone\n\n# Check authorized SSH keys (backdoor detection)\necho \"=== SSH AUTHORIZED KEYS ===\" > \u002Fcases\u002Fcase-2024-001\u002Flinux\u002Fpersistence\u002Fssh_keys.txt\nfind \u002Fmnt\u002Fevidence\u002Fhome\u002F \u002Fmnt\u002Fevidence\u002Froot\u002F -name \"authorized_keys\" -exec sh -c \\\n   'echo \"--- {} ---\"; cat {}; echo \"\"' \\; >> \u002Fcases\u002Fcase-2024-001\u002Flinux\u002Fpersistence\u002Fssh_keys.txt\n\n# Check rc.local and init scripts\ncat \u002Fmnt\u002Fevidence\u002Fetc\u002Frc.local 2>\u002Fdev\u002Fnull > \u002Fcases\u002Fcase-2024-001\u002Flinux\u002Fpersistence\u002Frc_local.txt\n\n# Check \u002Fetc\u002Fprofile.d\u002F for login-triggered scripts\nls -la \u002Fmnt\u002Fevidence\u002Fetc\u002Fprofile.d\u002F > \u002Fcases\u002Fcase-2024-001\u002Flinux\u002Fpersistence\u002Fprofile_scripts.txt\n\n# Check for LD_PRELOAD hijacking\ngrep -r \"LD_PRELOAD\" \u002Fmnt\u002Fevidence\u002Fetc\u002F 2>\u002Fdev\u002Fnull > \u002Fcases\u002Fcase-2024-001\u002Flinux\u002Fpersistence\u002Fld_preload.txt\ncat \u002Fmnt\u002Fevidence\u002Fetc\u002Fld.so.preload 2>\u002Fdev\u002Fnull >> \u002Fcases\u002Fcase-2024-001\u002Flinux\u002Fpersistence\u002Fld_preload.txt\n```\n\n### Step 4: Analyze Shell History and Command Execution\n\n```bash\n# Analyze bash history for each user\npython3 \u003C\u003C 'PYEOF'\nimport os, glob\n\nprint(\"=== SHELL HISTORY ANALYSIS ===\\n\")\n\nsuspicious_commands = [\n    'wget', 'curl', 'nc ', 'ncat', 'netcat', 'python -c', 'python3 -c',\n    'perl -e', 'base64', 'chmod 777', 'chmod +s', '\u002Fdev\u002Ftcp', '\u002Fdev\u002Fudp',\n    'nmap', 'masscan', 'hydra', 'john', 'hashcat', 'passwd', 'useradd',\n    'iptables -F', 'ufw disable', 'history -c', 'rm -rf \u002F', 'dd if=',\n    'crontab', 'at ', 'systemctl enable', 'ssh-keygen', 'scp ', 'rsync',\n    'tar czf', 'zip -r', 'openssl enc', 'gpg --encrypt', 'shred',\n    'chattr', 'setfacl', 'awk', '\u002Ftmp\u002F', '\u002Fdev\u002Fshm\u002F'\n]\n\nfor hist_file in glob.glob('\u002Fcases\u002Fcase-2024-001\u002Flinux\u002Fusers\u002F*\u002F.bash_history'):\n    username = hist_file.split('\u002F')[-2]\n    print(f\"User: {username}\")\n\n    with open(hist_file, 'r', errors='ignore') as f:\n        lines = f.readlines()\n\n    print(f\"  Total commands: {len(lines)}\")\n    flagged = []\n    for i, line in enumerate(lines):\n        line = line.strip()\n        for cmd in suspicious_commands:\n            if cmd in line.lower():\n                flagged.append((i+1, line))\n                break\n\n    if flagged:\n        print(f\"  Suspicious commands: {len(flagged)}\")\n        for lineno, cmd in flagged:\n            print(f\"    Line {lineno}: {cmd[:120]}\")\n    print()\nPYEOF\n```\n\n### Step 5: Check for Rootkits and Modified Binaries\n\n```bash\n# Check for known rootkit indicators\n# Compare system binary hashes against known-good\nfind \u002Fmnt\u002Fevidence\u002Fusr\u002Fbin\u002F \u002Fmnt\u002Fevidence\u002Fusr\u002Fsbin\u002F \u002Fmnt\u002Fevidence\u002Fbin\u002F \u002Fmnt\u002Fevidence\u002Fsbin\u002F \\\n   -type f -executable -exec sha256sum {} \\; > \u002Fcases\u002Fcase-2024-001\u002Flinux\u002Fanalysis\u002Fbinary_hashes.txt\n\n# Check for SUID\u002FSGID binaries (potential privilege escalation)\nfind \u002Fmnt\u002Fevidence\u002F -perm -4000 -type f 2>\u002Fdev\u002Fnull > \u002Fcases\u002Fcase-2024-001\u002Flinux\u002Fanalysis\u002Fsuid_files.txt\nfind \u002Fmnt\u002Fevidence\u002F -perm -2000 -type f 2>\u002Fdev\u002Fnull > \u002Fcases\u002Fcase-2024-001\u002Flinux\u002Fanalysis\u002Fsgid_files.txt\n\n# Check for suspicious files in \u002Ftmp and \u002Fdev\u002Fshm\nfind \u002Fmnt\u002Fevidence\u002Ftmp\u002F \u002Fmnt\u002Fevidence\u002Fdev\u002Fshm\u002F -type f 2>\u002Fdev\u002Fnull \\\n   -exec file {} \\; > \u002Fcases\u002Fcase-2024-001\u002Flinux\u002Fanalysis\u002Ftmp_files.txt\n\n# Check for hidden files and directories\nfind \u002Fmnt\u002Fevidence\u002F -name \".*\" -not -path \"*\u002F\\.\" -type f 2>\u002Fdev\u002Fnull | \\\n   head -100 > \u002Fcases\u002Fcase-2024-001\u002Flinux\u002Fanalysis\u002Fhidden_files.txt\n\n# Check kernel modules\nls -la \u002Fmnt\u002Fevidence\u002Flib\u002Fmodules\u002F$(ls \u002Fmnt\u002Fevidence\u002Flib\u002Fmodules\u002F | head -1)\u002Fextra\u002F 2>\u002Fdev\u002Fnull \\\n   > \u002Fcases\u002Fcase-2024-001\u002Flinux\u002Fanalysis\u002Fextra_modules.txt\n\n# Check for modified PAM configuration (authentication backdoors)\ndiff \u002Fmnt\u002Fevidence\u002Fetc\u002Fpam.d\u002F \u002Fcases\u002Fbaseline\u002Fpam.d\u002F 2>\u002Fdev\u002Fnull \\\n   > \u002Fcases\u002Fcase-2024-001\u002Flinux\u002Fanalysis\u002Fpam_changes.txt\n```\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| \u002Fvar\u002Flog\u002Fauth.log | Primary authentication log on Debian\u002FUbuntu systems |\n| \u002Fvar\u002Flog\u002Fsecure | Primary authentication log on RHEL\u002FCentOS systems |\n| wtmp\u002Fbtmp | Binary logs recording successful and failed login sessions |\n| .bash_history | User command history file (can be cleared by attackers) |\n| crontab | Scheduled task system commonly used for persistence |\n| authorized_keys | SSH public keys granting passwordless access to an account |\n| SUID bit | File permission allowing execution as the file owner (privilege escalation vector) |\n| LD_PRELOAD | Environment variable that loads a shared library before all others (hooking technique) |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| chkrootkit | Rootkit detection scanner for Linux systems |\n| rkhunter | Rootkit Hunter - checks for rootkits, backdoors, and local exploits |\n| AIDE | Advanced Intrusion Detection Environment - file integrity monitor |\n| auditd | Linux audit framework for system call and file access monitoring |\n| last\u002Flastb | Parse wtmp\u002Fbtmp for login and failed login history |\n| Plaso\u002Flog2timeline | Super-timeline creation including Linux artifacts |\n| osquery | SQL-based system querying for live forensic investigation |\n| Velociraptor | Endpoint agent with Linux artifact collection capabilities |\n\n## Common Scenarios\n\n**Scenario 1: SSH Brute Force Followed by Compromise**\nAnalyze auth.log for failed SSH attempts followed by success, identify the attacking IP, check .bash_history for post-compromise commands, examine authorized_keys for added backdoor keys, check crontab for persistence, review network connections.\n\n**Scenario 2: Web Server Compromise via Application Vulnerability**\nExamine web server access and error logs for exploitation attempts, check \u002Ftmp and \u002Fdev\u002Fshm for webshells, analyze the web server user's activity (www-data), check for privilege escalation via SUID binaries or kernel exploits, review outbound connections.\n\n**Scenario 3: Insider Threat on Database Server**\nAnalyze the suspect user's bash_history for database dump commands, check for large tar\u002Fzip files in home directory or \u002Ftmp, examine scp\u002Frsync commands for data transfer, review cron jobs for automated exfiltration, check USB device logs.\n\n**Scenario 4: Crypto-Miner on Cloud Instance**\nCheck for high-CPU processes in \u002Fproc (live) or systemd service files, examine crontab entries for miner restart scripts, check \u002Ftmp for mining binaries, analyze network connections for mining pool communications, review authorized_keys for attacker access.\n\n## Output Format\n\n```\nLinux Forensics Summary:\n  System: webserver01 (Ubuntu 22.04 LTS)\n  Hostname: webserver01.corp.local\n  Kernel: 5.15.0-91-generic\n\n  User Accounts:\n    Total: 25 (3 with UID 0 - 1 ANOMALOUS)\n    Interactive shells: 8 users\n    Recently created: admin2 (created 2024-01-15)\n\n  Authentication Events:\n    Successful SSH logins: 456\n    Failed SSH attempts: 12,345 (from 23 unique IPs)\n    Sudo executions: 89\n\n  Persistence Mechanisms Found:\n    Cron jobs: 3 suspicious (reverse shell, miner restart)\n    Systemd services: 1 unknown (update-checker.service)\n    SSH keys: 2 unauthorized keys in root authorized_keys\n    rc.local: Modified with download cradle\n\n  Suspicious Activity:\n    - bash_history contains wget to pastebin URL\n    - SUID binary \u002Ftmp\u002F.hidden\u002Fescalate found\n    - \u002Fdev\u002Fshm\u002F contains compiled ELF binary\n    - LD_PRELOAD in \u002Fetc\u002Fld.so.preload pointing to \u002Flib\u002F.hidden.so\n\n  Report: \u002Fcases\u002Fcase-2024-001\u002Flinux\u002Fanalysis\u002F\n```\n","# Analyzing Linux System Artifacts\n\n## When to Use\n- When investigating a compromised Linux server or workstation\n- For identifying persistence mechanisms (cron, systemd, SSH keys)\n- When tracing user activity through shell history and authentication logs\n- During incident response to determine the scope of a Linux-based breach\n- For detecting rootkits, backdoors, and unauthorized modifications\n\n## Prerequisites\n- Forensic image or live access to the Linux system (read-only)\n- Understanding of Linux file system hierarchy (FHS)\n- Knowledge of common Linux logging locations (\u002Fvar\u002Flog\u002F)\n- Tools: chkrootkit, rkhunter, AIDE, auditd logs\n- Familiarity with systemd, cron, and PAM configurations\n- Root access for complete artifact collection\n\n## Workflow\n\n### Step 1: Mount and Collect System Artifacts\n\n```bash\n# Mount forensic image read-only\nmount -o ro,loop,offset=$((2048*512)) \u002Fcases\u002Fcase-2024-001\u002Fimages\u002Flinux_evidence.dd \u002Fmnt\u002Fevidence\n\n# Create collection directories\nmkdir -p \u002Fcases\u002Fcase-2024-001\u002Flinux\u002F{logs,config,users,persistence,network}\n\n# Collect authentication logs\ncp \u002Fmnt\u002Fevidence\u002Fvar\u002Flog\u002Fauth.log* \u002Fcases\u002Fcase-2024-001\u002Flinux\u002Flogs\u002F\ncp \u002Fmnt\u002Fevidence\u002Fvar\u002Flog\u002Fsecure* \u002Fcases\u002Fcase-2024-001\u002Flinux\u002Flogs\u002F\ncp \u002Fmnt\u002Fevidence\u002Fvar\u002Flog\u002Fsyslog* \u002Fcases\u002Fcase-2024-001\u002Flinux\u002Flogs\u002F\ncp \u002Fmnt\u002Fevidence\u002Fvar\u002Flog\u002Fkern.log* \u002Fcases\u002Fcase-2024-001\u002Flinux\u002Flogs\u002F\ncp \u002Fmnt\u002Fevidence\u002Fvar\u002Flog\u002Faudit\u002Faudit.log* \u002Fcases\u002Fcase-2024-001\u002Flinux\u002Flogs\u002F\ncp \u002Fmnt\u002Fevidence\u002Fvar\u002Flog\u002Fwtmp \u002Fcases\u002Fcase-2024-001\u002Flinux\u002Flogs\u002F\ncp \u002Fmnt\u002Fevidence\u002Fvar\u002Flog\u002Fbtmp \u002Fcases\u002Fcase-2024-001\u002Flinux\u002Flogs\u002F\ncp \u002Fmnt\u002Fevidence\u002Fvar\u002Flog\u002Flastlog \u002Fcases\u002Fcase-2024-001\u002Flinux\u002Flogs\u002F\ncp \u002Fmnt\u002Fevidence\u002Fvar\u002Flog\u002Ffaillog \u002Fcases\u002Fcase-2024-001\u002Flinux\u002Flogs\u002F\n\n# Collect user artifacts\nfor user_dir in \u002Fmnt\u002Fevidence\u002Fhome\u002F*\u002F; do\n    username=$(basename \"$user_dir\")\n    mkdir -p \u002Fcases\u002Fcase-2024-001\u002Flinux\u002Fusers\u002F$username\n    cp \"$user_dir\"\u002F.bash_history \u002Fcases\u002Fcase-2024-001\u002Flinux\u002Fusers\u002F$username\u002F 2>\u002Fdev\u002Fnull\n    cp \"$user_dir\"\u002F.zsh_history \u002Fcases\u002Fcase-2024-001\u002Flinux\u002Fusers\u002F$username\u002F 2>\u002Fdev\u002Fnull\n    cp -r \"$user_dir\"\u002F.ssh\u002F \u002Fcases\u002Fcase-2024-001\u002Flinux\u002Fusers\u002F$username\u002F 2>\u002Fdev\u002Fnull\n    cp \"$user_dir\"\u002F.bashrc \u002Fcases\u002Fcase-2024-001\u002Flinux\u002Fusers\u002F$username\u002F 2>\u002Fdev\u002Fnull\n    cp \"$user_dir\"\u002F.profile \u002Fcases\u002Fcase-2024-001\u002Flinux\u002Fusers\u002F$username\u002F 2>\u002Fdev\u002Fnull\n    cp \"$user_dir\"\u002F.viminfo \u002Fcases\u002Fcase-2024-001\u002Flinux\u002Fusers\u002F$username\u002F 2>\u002Fdev\u002Fnull\n    cp \"$user_dir\"\u002F.wget-hsts \u002Fcases\u002Fcase-2024-001\u002Flinux\u002Fusers\u002F$username\u002F 2>\u002Fdev\u002Fnull\n    cp \"$user_dir\"\u002F.python_history \u002Fcases\u002Fcase-2024-001\u002Flinux\u002Fusers\u002F$username\u002F 2>\u002Fdev\u002Fnull\ndone\n\n# Collect root user artifacts\ncp \u002Fmnt\u002Fevidence\u002Froot\u002F.bash_history \u002Fcases\u002Fcase-2024-001\u002Flinux\u002Fusers\u002Froot\u002F 2>\u002Fdev\u002Fnull\ncp -r \u002Fmnt\u002Fevidence\u002Froot\u002F.ssh\u002F \u002Fcases\u002Fcase-2024-001\u002Flinux\u002Fusers\u002Froot\u002F 2>\u002Fdev\u002Fnull\n\n# Collect system configuration\ncp \u002Fmnt\u002Fevidence\u002Fetc\u002Fpasswd \u002Fcases\u002Fcase-2024-001\u002Flinux\u002Fconfig\u002F\ncp \u002Fmnt\u002Fevidence\u002Fetc\u002Fshadow \u002Fcases\u002Fcase-2024-001\u002Flinux\u002Fconfig\u002F\ncp \u002Fmnt\u002Fevidence\u002Fetc\u002Fgroup \u002Fcases\u002Fcase-2024-001\u002Flinux\u002Fconfig\u002F\ncp \u002Fmnt\u002Fevidence\u002Fetc\u002Fsudoers \u002Fcases\u002Fcase-2024-001\u002Flinux\u002Fconfig\u002F\ncp -r \u002Fmnt\u002Fevidence\u002Fetc\u002Fsudoers.d\u002F \u002Fcases\u002Fcase-2024-001\u002Flinux\u002Fconfig\u002F\ncp \u002Fmnt\u002Fevidence\u002Fetc\u002Fhosts \u002Fcases\u002Fcase-2024-001\u002Flinux\u002Fconfig\u002F\ncp \u002Fmnt\u002Fevidence\u002Fetc\u002Fresolv.conf \u002Fcases\u002Fcase-2024-001\u002Flinux\u002Fconfig\u002F\ncp -r \u002Fmnt\u002Fevidence\u002Fetc\u002Fssh\u002F \u002Fcases\u002Fcase-2024-001\u002Flinux\u002Fconfig\u002F\n```\n\n### Step 2: Analyze User Accounts and Authentication\n\n```bash\n# Analyze user accounts for anomalies\npython3 \u003C\u003C 'PYEOF'\nprint(\"=== USER ACCOUNT ANALYSIS ===\\n\")\n\n# Parse \u002Fetc\u002Fpasswd\nwith open('\u002Fcases\u002Fcase-2024-001\u002Flinux\u002Fconfig\u002Fpasswd') as f:\n    for line in f:\n        parts = line.strip().split(':')\n        if len(parts) >= 7:\n            username, _, uid, gid, comment, home, shell = parts[0], parts[1], int(parts[2]), int(parts[3]), parts[4], parts[5], parts[6]\n\n            # Flag accounts with UID 0 (root equivalent)\n            if uid == 0 and username != 'root':\n                print(f\"  ALERT: UID 0 account: {username} (shell: {shell})\")\n\n            # Flag accounts with login shells that shouldn't have them\n            if shell not in ('\u002Fbin\u002Ffalse', '\u002Fusr\u002Fsbin\u002Fnologin', '\u002Fbin\u002Fsync') and uid >= 1000:\n                print(f\"  User: {username} (UID:{uid}, Shell:{shell}, Home:{home})\")\n\n            # Flag system accounts with login shells\n            if uid \u003C 1000 and uid > 0 and shell in ('\u002Fbin\u002Fbash', '\u002Fbin\u002Fsh', '\u002Fbin\u002Fzsh'):\n                print(f\"  WARNING: System account with shell: {username} (UID:{uid}, Shell:{shell})\")\n\n# Parse \u002Fetc\u002Fshadow for account status\nprint(\"\\n=== PASSWORD STATUS ===\")\nwith open('\u002Fcases\u002Fcase-2024-001\u002Flinux\u002Fconfig\u002Fshadow') as f:\n    for line in f:\n        parts = line.strip().split(':')\n        if len(parts) >= 3:\n            username = parts[0]\n            pwd_hash = parts[1]\n            last_change = parts[2]\n\n            if pwd_hash and pwd_hash not in ('*', '!', '!!', ''):\n                hash_type = 'Unknown'\n                if pwd_hash.startswith('$6$'): hash_type = 'SHA-512'\n                elif pwd_hash.startswith('$5$'): hash_type = 'SHA-256'\n                elif pwd_hash.startswith('$y$'): hash_type = 'yescrypt'\n                elif pwd_hash.startswith('$1$'): hash_type = 'MD5 (WEAK)'\n                print(f\"  {username}: {hash_type} hash, last changed: day {last_change}\")\nPYEOF\n\n# Analyze login history\nlast -f \u002Fcases\u002Fcase-2024-001\u002Flinux\u002Flogs\u002Fwtmp > \u002Fcases\u002Fcase-2024-001\u002Flinux\u002Fanalysis\u002Flogin_history.txt\nlastb -f \u002Fcases\u002Fcase-2024-001\u002Flinux\u002Flogs\u002Fbtmp > \u002Fcases\u002Fcase-2024-001\u002Flinux\u002Fanalysis\u002Ffailed_logins.txt 2>\u002Fdev\u002Fnull\n```\n\n### Step 3: Examine Persistence Mechanisms\n\n```bash\n# Check cron jobs for all users\necho \"=== CRON JOBS ===\" > \u002Fcases\u002Fcase-2024-001\u002Flinux\u002Fpersistence\u002Fcron_analysis.txt\n\n# System cron\nfor cronfile in \u002Fmnt\u002Fevidence\u002Fetc\u002Fcrontab \u002Fmnt\u002Fevidence\u002Fetc\u002Fcron.d\u002F*; do\n    echo \"--- $cronfile ---\" >> \u002Fcases\u002Fcase-2024-001\u002Flinux\u002Fpersistence\u002Fcron_analysis.txt\n    cat \"$cronfile\" 2>\u002Fdev\u002Fnull >> \u002Fcases\u002Fcase-2024-001\u002Flinux\u002Fpersistence\u002Fcron_analysis.txt\n    echo \"\" >> \u002Fcases\u002Fcase-2024-001\u002Flinux\u002Fpersistence\u002Fcron_analysis.txt\ndone\n\n# User cron tabs\nfor cronfile in \u002Fmnt\u002Fevidence\u002Fvar\u002Fspool\u002Fcron\u002Fcrontabs\u002F*; do\n    echo \"--- User crontab: $(basename $cronfile) ---\" >> \u002Fcases\u002Fcase-2024-001\u002Flinux\u002Fpersistence\u002Fcron_analysis.txt\n    cat \"$cronfile\" 2>\u002Fdev\u002Fnull >> \u002Fcases\u002Fcase-2024-001\u002Flinux\u002Fpersistence\u002Fcron_analysis.txt\n    echo \"\" >> \u002Fcases\u002Fcase-2024-001\u002Flinux\u002Fpersistence\u002Fcron_analysis.txt\ndone\n\n# Check systemd services for persistence\necho \"=== SYSTEMD SERVICES ===\" > \u002Fcases\u002Fcase-2024-001\u002Flinux\u002Fpersistence\u002Fsystemd_analysis.txt\nfind \u002Fmnt\u002Fevidence\u002Fetc\u002Fsystemd\u002Fsystem\u002F -name \"*.service\" -newer \u002Fmnt\u002Fevidence\u002Fetc\u002Fos-release \\\n   >> \u002Fcases\u002Fcase-2024-001\u002Flinux\u002Fpersistence\u002Fsystemd_analysis.txt\n\nfor svc in \u002Fmnt\u002Fevidence\u002Fetc\u002Fsystemd\u002Fsystem\u002F*.service; do\n    echo \"--- $(basename $svc) ---\" >> \u002Fcases\u002Fcase-2024-001\u002Flinux\u002Fpersistence\u002Fsystemd_analysis.txt\n    cat \"$svc\" >> \u002Fcases\u002Fcase-2024-001\u002Flinux\u002Fpersistence\u002Fsystemd_analysis.txt\n    echo \"\" >> \u002Fcases\u002Fcase-2024-001\u002Flinux\u002Fpersistence\u002Fsystemd_analysis.txt\ndone\n\n# Check authorized SSH keys (backdoor detection)\necho \"=== SSH AUTHORIZED KEYS ===\" > \u002Fcases\u002Fcase-2024-001\u002Flinux\u002Fpersistence\u002Fssh_keys.txt\nfind \u002Fmnt\u002Fevidence\u002Fhome\u002F \u002Fmnt\u002Fevidence\u002Froot\u002F -name \"authorized_keys\" -exec sh -c \\\n   'echo \"--- {} ---\"; cat {}; echo \"\"' \\; >> \u002Fcases\u002Fcase-2024-001\u002Flinux\u002Fpersistence\u002Fssh_keys.txt\n\n# Check rc.local and init scripts\ncat \u002Fmnt\u002Fevidence\u002Fetc\u002Frc.local 2>\u002Fdev\u002Fnull > \u002Fcases\u002Fcase-2024-001\u002Flinux\u002Fpersistence\u002Frc_local.txt\n\n# Check \u002Fetc\u002Fprofile.d\u002F for login-triggered scripts\nls -la \u002Fmnt\u002Fevidence\u002Fetc\u002Fprofile.d\u002F > \u002Fcases\u002Fcase-2024-001\u002Flinux\u002Fpersistence\u002Fprofile_scripts.txt\n\n# Check for LD_PRELOAD hijacking\ngrep -r \"LD_PRELOAD\" \u002Fmnt\u002Fevidence\u002Fetc\u002F 2>\u002Fdev\u002Fnull > \u002Fcases\u002Fcase-2024-001\u002Flinux\u002Fpersistence\u002Fld_preload.txt\ncat \u002Fmnt\u002Fevidence\u002Fetc\u002Fld.so.preload 2>\u002Fdev\u002Fnull >> \u002Fcases\u002Fcase-2024-001\u002Flinux\u002Fpersistence\u002Fld_preload.txt\n```\n\n### Step 4: Analyze Shell History and Command Execution\n\n```bash\n# Analyze bash history for each user\npython3 \u003C\u003C 'PYEOF'\nimport os, glob\n\nprint(\"=== SHELL HISTORY ANALYSIS ===\\n\")\n\nsuspicious_commands = [\n    'wget', 'curl', 'nc ', 'ncat', 'netcat', 'python -c', 'python3 -c',\n    'perl -e', 'base64', 'chmod 777', 'chmod +s', '\u002Fdev\u002Ftcp', '\u002Fdev\u002Fudp',\n    'nmap', 'masscan', 'hydra', 'john', 'hashcat', 'passwd', 'useradd',\n    'iptables -F', 'ufw disable', 'history -c', 'rm -rf \u002F', 'dd if=',\n    'crontab', 'at ', 'systemctl enable', 'ssh-keygen', 'scp ', 'rsync',\n    'tar czf', 'zip -r', 'openssl enc', 'gpg --encrypt', 'shred',\n    'chattr', 'setfacl', 'awk', '\u002Ftmp\u002F', '\u002Fdev\u002Fshm\u002F'\n]\n\nfor hist_file in glob.glob('\u002Fcases\u002Fcase-2024-001\u002Flinux\u002Fusers\u002F*\u002F.bash_history'):\n    username = hist_file.split('\u002F')[-2]\n    print(f\"User: {username}\")\n\n    with open(hist_file, 'r', errors='ignore') as f:\n        lines = f.readlines()\n\n    print(f\"  Total commands: {len(lines)}\")\n    flagged = []\n    for i, line in enumerate(lines):\n        line = line.strip()\n        for cmd in suspicious_commands:\n            if cmd in line.lower():\n                flagged.append((i+1, line))\n                break\n\n    if flagged:\n        print(f\"  Suspicious commands: {len(flagged)}\")\n        for lineno, cmd in flagged:\n            print(f\"    Line {lineno}: {cmd[:120]}\")\n    print()\nPYEOF\n```\n\n### Step 5: Check for Rootkits and Modified Binaries\n\n```bash\n# Check for known rootkit indicators\n# Compare system binary hashes against known-good\nfind \u002Fmnt\u002Fevidence\u002Fusr\u002Fbin\u002F \u002Fmnt\u002Fevidence\u002Fusr\u002Fsbin\u002F \u002Fmnt\u002Fevidence\u002Fbin\u002F \u002Fmnt\u002Fevidence\u002Fsbin\u002F \\\n   -type f -executable -exec sha256sum {} \\; > \u002Fcases\u002Fcase-2024-001\u002Flinux\u002Fanalysis\u002Fbinary_hashes.txt\n\n# Check for SUID\u002FSGID binaries (potential privilege escalation)\nfind \u002Fmnt\u002Fevidence\u002F -perm -4000 -type f 2>\u002Fdev\u002Fnull > \u002Fcases\u002Fcase-2024-001\u002Flinux\u002Fanalysis\u002Fsuid_files.txt\nfind \u002Fmnt\u002Fevidence\u002F -perm -2000 -type f 2>\u002Fdev\u002Fnull > \u002Fcases\u002Fcase-2024-001\u002Flinux\u002Fanalysis\u002Fsgid_files.txt\n\n# Check for suspicious files in \u002Ftmp and \u002Fdev\u002Fshm\nfind \u002Fmnt\u002Fevidence\u002Ftmp\u002F \u002Fmnt\u002Fevidence\u002Fdev\u002Fshm\u002F -type f 2>\u002Fdev\u002Fnull \\\n   -exec file {} \\; > \u002Fcases\u002Fcase-2024-001\u002Flinux\u002Fanalysis\u002Ftmp_files.txt\n\n# Check for hidden files and directories\nfind \u002Fmnt\u002Fevidence\u002F -name \".*\" -not -path \"*\u002F\\.\" -type f 2>\u002Fdev\u002Fnull | \\\n   head -100 > \u002Fcases\u002Fcase-2024-001\u002Flinux\u002Fanalysis\u002Fhidden_files.txt\n\n# Check kernel modules\nls -la \u002Fmnt\u002Fevidence\u002Flib\u002Fmodules\u002F$(ls \u002Fmnt\u002Fevidence\u002Flib\u002Fmodules\u002F | head -1)\u002Fextra\u002F 2>\u002Fdev\u002Fnull \\\n   > \u002Fcases\u002Fcase-2024-001\u002Flinux\u002Fanalysis\u002Fextra_modules.txt\n\n# Check for modified PAM configuration (authentication backdoors)\ndiff \u002Fmnt\u002Fevidence\u002Fetc\u002Fpam.d\u002F \u002Fcases\u002Fbaseline\u002Fpam.d\u002F 2>\u002Fdev\u002Fnull \\\n   > \u002Fcases\u002Fcase-2024-001\u002Flinux\u002Fanalysis\u002Fpam_changes.txt\n```\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| \u002Fvar\u002Flog\u002Fauth.log | Primary authentication log on Debian\u002FUbuntu systems |\n| \u002Fvar\u002Flog\u002Fsecure | Primary authentication log on RHEL\u002FCentOS systems |\n| wtmp\u002Fbtmp | Binary logs recording successful and failed login sessions |\n| .bash_history | User command history file (can be cleared by attackers) |\n| crontab | Scheduled task system commonly used for persistence |\n| authorized_keys | SSH public keys granting passwordless access to an account |\n| SUID bit | File permission allowing execution as the file owner (privilege escalation vector) |\n| LD_PRELOAD | Environment variable that loads a shared library before all others (hooking technique) |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| chkrootkit | Rootkit detection scanner for Linux systems |\n| rkhunter | Rootkit Hunter - checks for rootkits, backdoors, and local exploits |\n| AIDE | Advanced Intrusion Detection Environment - file integrity monitor |\n| auditd | Linux audit framework for system call and file access monitoring |\n| last\u002Flastb | Parse wtmp\u002Fbtmp for login and failed login history |\n| Plaso\u002Flog2timeline | Super-timeline creation including Linux artifacts |\n| osquery | SQL-based system querying for live forensic investigation |\n| Velociraptor | Endpoint agent with Linux artifact collection capabilities |\n\n## Common Scenarios\n\n**Scenario 1: SSH Brute Force Followed by Compromise**\nAnalyze auth.log for failed SSH attempts followed by success, identify the attacking IP, check .bash_history for post-compromise commands, examine authorized_keys for added backdoor keys, check crontab for persistence, review network connections.\n\n**Scenario 2: Web Server Compromise via Application Vulnerability**\nExamine web server access and error logs for exploitation attempts, check \u002Ftmp and \u002Fdev\u002Fshm for webshells, analyze the web server user's activity (www-data), check for privilege escalation via SUID binaries or kernel exploits, review outbound connections.\n\n**Scenario 3: Insider Threat on Database Server**\nAnalyze the suspect user's bash_history for database dump commands, check for large tar\u002Fzip files in home directory or \u002Ftmp, examine scp\u002Frsync commands for data transfer, review cron jobs for automated exfiltration, check USB device logs.\n\n**Scenario 4: Crypto-Miner on Cloud Instance**\nCheck for high-CPU processes in \u002Fproc (live) or systemd service files, examine crontab entries for miner restart scripts, check \u002Ftmp for mining binaries, analyze network connections for mining pool communications, review authorized_keys for attacker access.\n\n## Output Format\n\n```\nLinux Forensics Summary:\n  System: webserver01 (Ubuntu 22.04 LTS)\n  Hostname: webserver01.corp.local\n  Kernel: 5.15.0-91-generic\n\n  User Accounts:\n    Total: 25 (3 with UID 0 - 1 ANOMALOUS)\n    Interactive shells: 8 users\n    Recently created: admin2 (created 2024-01-15)\n\n  Authentication Events:\n    Successful SSH logins: 456\n    Failed SSH attempts: 12,345 (from 23 unique IPs)\n    Sudo executions: 89\n\n  Persistence Mechanisms Found:\n    Cron jobs: 3 suspicious (reverse shell, miner restart)\n    Systemd services: 1 unknown (update-checker.service)\n    SSH keys: 2 unauthorized keys in root authorized_keys\n    rc.local: Modified with download cradle\n\n  Suspicious Activity:\n    - bash_history contains wget to pastebin URL\n    - SUID binary \u002Ftmp\u002F.hidden\u002Fescalate found\n    - \u002Fdev\u002Fshm\u002F contains compiled ELF binary\n    - LD_PRELOAD in \u002Fetc\u002Fld.so.preload pointing to \u002Flib\u002F.hidden.so\n\n  Report: \u002Fcases\u002Fcase-2024-001\u002Flinux\u002Fanalysis\u002F\n```\n",{"name":5,"tags":49,"author":51,"domain":43,"license":15,"version":52,"nist_csf":53,"subdomain":35,"description":7,"mitre_attack":58},[50,40,39,38,37,36],"forensics","mahipal","1.0",[54,55,56,57],"RS.AN-01","RS.AN-03","DE.AE-02","RS.MA-01",[59,60,61,62],"T1070","T1059.004","T1543.002","T1053.003","main","7925716f065257435fdb12e97f7e52842147d5ad",".claude\u002Fskills\u002Fanalyzing-linux-system-artifacts","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude","https:\u002F\u002Fclaude.com\u002Fclaude-code","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho","Software · Applied AI · Quantitative Modeling · Building with Claude.","2026-06-10 12:24:46",{"source":8,"skillName":5,"commands":72,"prompt":82,"zipAvailable":83},[73,76,79],{"tool":74,"command":75},"npx","npx skills add henriquescastilho\u002Fmy-claude --skill analyzing-linux-system-artifacts",{"tool":77,"command":78},"bunx","bunx skills add henriquescastilho\u002Fmy-claude --skill analyzing-linux-system-artifacts",{"tool":80,"command":81},"pnpm","pnpm dlx skills add henriquescastilho\u002Fmy-claude --skill analyzing-linux-system-artifacts","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fanalyzing-linux-system-artifacts\u002FSKILL.md",true,[85,90,96],{"path":86,"resourceType":86,"resourceTypeDesc":87,"sizeBytes":88,"sourceHtmlUrl":89},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fanalyzing-linux-system-artifacts\u002FLICENSE",{"path":91,"resourceType":92,"resourceTypeDesc":93,"sizeBytes":94,"sourceHtmlUrl":95},"references\u002Fapi-reference.md","REFERENCE","参考文档",3491,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fanalyzing-linux-system-artifacts\u002Freferences\u002Fapi-reference.md",{"path":97,"resourceType":98,"resourceTypeDesc":99,"sizeBytes":100,"sourceHtmlUrl":101},"scripts\u002Fagent.py","SCRIPT","脚本",9952,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fanalyzing-linux-system-artifacts\u002Fscripts\u002Fagent.py",[103,144,153,162,184,209],{"skillNo":104,"name":105,"nameZh":6,"description":106,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":107,"licenseFileUrl":6,"sourceHtmlUrl":108,"categories":109,"keywords":124,"publishedAt":44},"01M6F0B6XPQ65AX2X0DWK8KT3E","markitdown","Convert files and office documents to Markdown. Supports PDF, DOCX, PPTX, XLSX, images (with OCR), audio (with transcription), HTML, CSV, JSON, XML, ZIP, YouTube URLs, EPubs and more.","MIT","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-writer\u002Fskills\u002Fmarkitdown\u002FSKILL.md",[110,113,116,119],{"categoryNo":111,"categoryName":112,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000002","文档处理",{"categoryNo":114,"categoryName":115,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000003","演示文稿",{"categoryNo":117,"categoryName":118,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000004","电子表格",{"categoryNo":120,"categoryName":121,"taxonomyType":122,"taxonomyTypeDesc":123},"01JBSEEDCAT000000000000034","行政与办公人员","PROFESSION","适用职业",[105,125,126,127,128,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143],"docx","PDF","pptx","xlsx","documents","csv","ocr","Audio","Bash","markdown","convert","read","write","edit","html","images","files","youtube","with",{"skillNo":145,"name":105,"nameZh":6,"description":106,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":107,"licenseFileUrl":6,"sourceHtmlUrl":146,"categories":147,"keywords":152,"publishedAt":44},"01M6F06SBHR9F0SDWE282Y8075","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-writer\u002Fscientific_writer\u002F.claude\u002Fskills\u002Fmarkitdown\u002FSKILL.md",[148,149,150,151],{"categoryNo":111,"categoryName":112,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":114,"categoryName":115,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":117,"categoryName":118,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":120,"categoryName":121,"taxonomyType":122,"taxonomyTypeDesc":123},[105,125,126,127,128,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143],{"skillNo":154,"name":105,"nameZh":6,"description":106,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":107,"licenseFileUrl":6,"sourceHtmlUrl":155,"categories":156,"keywords":161,"publishedAt":44},"01M6F02D4R14EJAPBWVDF9J9VQ","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-writer\u002F.claude\u002Fskills\u002Fmarkitdown\u002FSKILL.md",[157,158,159,160],{"categoryNo":111,"categoryName":112,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":114,"categoryName":115,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":117,"categoryName":118,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":120,"categoryName":121,"taxonomyType":122,"taxonomyTypeDesc":123},[105,125,126,127,128,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143],{"skillNo":163,"name":164,"nameZh":6,"description":165,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":107,"licenseFileUrl":6,"sourceHtmlUrl":166,"categories":167,"keywords":168,"publishedAt":44},"01M6F000KS6YB4MKS774G4R8ND","zarr-python","Chunked N-D arrays for cloud storage. Compressed arrays, parallel I\u002FO, S3\u002FGCS integration, NumPy\u002FDask\u002FXarray compatible, for large-scale scientific computing pipelines.","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-skills\u002Fscientific-skills\u002Fzarr-python\u002FSKILL.md",[],[169,170,171,172,173,174,175,176,177,178,179,180,181,182,183],"python","zarr python","storage","integration","s3","gcs","cloud","dask","parallel","pipelines","arrays","numpy","scientific computing","scale","scientific",{"skillNo":185,"name":186,"nameZh":6,"description":187,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":107,"licenseFileUrl":6,"sourceHtmlUrl":188,"categories":189,"keywords":191,"publishedAt":44},"01M6EZZJWFXM1GR78KTW6J0DN8","what-if-oracle","Run structured What-If scenario analysis with multi-branch possibility exploration. Use this skill when the user asks speculative questions like \"what if...\", \"what would happen if...\", \"what are the possibilities\", \"explore scenarios\", \"scenario analysis\", \"possibility space\", \"what could go wrong\", \"best case \u002F worst case\", \"risk analysis\", \"contingency planning\", \"strategic options\", or any question about uncertain futures. Also trigger when the user faces a fork-in-the-road decision, wants to stress-test an idea, or needs to think through consequences before committing.","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-skills\u002Fscientific-skills\u002Fwhat-if-oracle\u002FSKILL.md",[190],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[192,193,194,195,196,197,34,198,199,200,201,136,137,202,203,204,205,206,207,208],"oracle","what if oracle","go","run","ux","futures","explore","decision","branch","question","idea","exploration","options","stress-test","strategies","scenario","stress",{"skillNo":210,"name":211,"nameZh":6,"description":212,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":107,"licenseFileUrl":6,"sourceHtmlUrl":213,"categories":214,"keywords":225,"publishedAt":44},"01M6EZZCXAEB49RXGQCJX5E8GB","venue-templates","Access comprehensive LaTeX templates, formatting requirements, and submission guidelines for major scientific publication venues (Nature, Science, PLOS, IEEE, ACM), academic conferences (NeurIPS, ICML, CVPR, CHI), research posters, and grant proposals (NSF, NIH, DOE, DARPA). This skill should be used when preparing manuscripts for journal submission, conference papers, research posters, or grant proposals and need venue-specific formatting requirements and templates.","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-skills\u002Fscientific-skills\u002Fvenue-templates\u002FSKILL.md",[215,218,221,222],{"categoryNo":216,"categoryName":217,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000018","写作与文案",{"categoryNo":219,"categoryName":220,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000021","资料检索与研究",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":223,"categoryName":224,"taxonomyType":122,"taxonomyTypeDesc":123},"01JBSEEDCAT000000000000036","内容创作者",[226,227,228,229,230,231,232,233,133,234,136,137,138,235,236,237,238,239,183,240],"templates","venue templates","research","guidelines","NeurIPS","ICML","LaTeX","science","access","proposals","Academic","requirements","formatting","journal","chi"]