[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71EAVWKKRTT59V7S2958AMH":3,"skill-same:01M71EAVWKKRTT59V7S2958AMH":56},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":24,"linkOnly":25,"markdownContent":26,"markdownBody":27,"frontMatter":28,"refName":29,"commitSha":30,"skillDirectory":31,"forksCount":14,"repositoryHtmlUrl":32,"repositoryHomepageUrl":6,"ownerHtmlUrl":33,"ownerBlogUrl":6,"ownerDescription":34,"updatedAt":35,"install":36,"resources":49},"01M71EAVWKKRTT59V7S2958AMH","linux-log-sysartifacts-persist",null,"Linux Log Sysartifacts Persist.","DCx7C5\u002Fai-marketplace","DCx7C5","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42419559?v=4","01M71C01G2AZV3NTNGWAWSHJPP","DC","01M71C01GQW6G50S2BYMS7PP3E",0,"MIT","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Flinux-log-sysartifacts-persist\u002FSKILL.md",[],[19,20,21,22,23],"linux","log","persist","linux log sysartifacts persist","cybersecurity","2026-11-10 10:12:30",false,"---\nname: linux-log-sysartifacts-persist\ndescription: \"Linux Log Sysartifacts Persist.\"\ndomain: cybersecurity\n---\n\n|\n| chkrootkit | Rootkit detection scanner for Linux systems |\n| rkhunter | Rootkit Hunter - checks for rootkits, backdoors, and local exploits |\n| AIDE | Advanced Intrusion Detection Environment - file integrity monitor |\n| auditd | Linux audit framework for system call and file access monitoring |\n| last\u002Flastb | Parse wtmp\u002Fbtmp for login and failed login history |\n| Plaso\u002Flog2timeline | Super-timeline creation including Linux artifacts |\n| osquery | SQL-based system querying for live forensic investigation |\n| Velociraptor | Endpoint agent with Linux artifact collection capabilities |\n\n## Common Scenarios\n\n**Scenario 1: SSH Brute Force Followed by Compromise**\nAnalyze auth.log for failed SSH attempts followed by success, identify the attacking IP, check .bash_history for post-compromise commands, examine authorized_keys for added backdoor keys, check crontab for persistence, review network connections.\n\n**Scenario 2: Web Server Compromise via Application Vulnerability**\nExamine web server access and error logs for exploitation attempts, check \u002Ftmp and \u002Fdev\u002Fshm for webshells, analyze the web server user's activity (www-data), check for privilege escalation via SUID binaries or kernel exploits, review outbound connections.\n\n**Scenario 3: Insider Threat on Database Server**\nAnalyze the suspect user's bash_history for database dump commands, check for large tar\u002Fzip files in home directory or \u002Ftmp, examine scp\u002Frsync commands for data transfer, review cron jobs for automated exfiltration, check USB device logs.\n\n**Scenario 4: Crypto-Miner on Cloud Instance**\nCheck for high-CPU processes in \u002Fproc (live) or systemd service files, examine crontab entries for miner restart scripts, check \u002Ftmp for mining binaries, analyze network connections for mining pool communications, review authorized_keys for attacker access.\n\n## Output Format\n\n```\nLinux Forensics Summary:\n  System: webserver01 (Ubuntu 22.04 LTS)\n  Hostname: webserver01.corp.local\n  Kernel: 5.15.0-91-generic\n\n  User Accounts:\n    Total: 25 (3 with UID 0 - 1 ANOMALOUS)\n    Interactive shells: 8 users\n    Recently created: admin2 (created 2024-01-15)\n\n  Authentication Events:\n    Successful SSH logins: 456\n    Failed SSH attempts: 12,345 (from 23 unique IPs)\n    Sudo executions: 89\n\n  Persistence Mechanisms Found:\n    Cron jobs: 3 suspicious (reverse shell, miner restart)\n    Systemd services: 1 unknown (update-checker.service)\n    SSH keys: 2 unauthorized keys in root authorized_keys\n    rc.local: Modified with download cradle\n\n  Suspicious Activity:\n    - bash_history contains wget to pastebin URL\n    - SUID binary \u002Ftmp\u002F.hidden\u002Fescalate found\n    - \u002Fdev\u002Fshm\u002F contains compiled ELF binary\n    - LD_PRELOAD in \u002Fetc\u002Fld.so.preload pointing to \u002Flib\u002F.hidden.so\n\n  Report: \u002Fcases\u002Fcase-2024-001\u002Flinux\u002Fanalysis\u002F\n```\n","|\n| chkrootkit | Rootkit detection scanner for Linux systems |\n| rkhunter | Rootkit Hunter - checks for rootkits, backdoors, and local exploits |\n| AIDE | Advanced Intrusion Detection Environment - file integrity monitor |\n| auditd | Linux audit framework for system call and file access monitoring |\n| last\u002Flastb | Parse wtmp\u002Fbtmp for login and failed login history |\n| Plaso\u002Flog2timeline | Super-timeline creation including Linux artifacts |\n| osquery | SQL-based system querying for live forensic investigation |\n| Velociraptor | Endpoint agent with Linux artifact collection capabilities |\n\n## Common Scenarios\n\n**Scenario 1: SSH Brute Force Followed by Compromise**\nAnalyze auth.log for failed SSH attempts followed by success, identify the attacking IP, check .bash_history for post-compromise commands, examine authorized_keys for added backdoor keys, check crontab for persistence, review network connections.\n\n**Scenario 2: Web Server Compromise via Application Vulnerability**\nExamine web server access and error logs for exploitation attempts, check \u002Ftmp and \u002Fdev\u002Fshm for webshells, analyze the web server user's activity (www-data), check for privilege escalation via SUID binaries or kernel exploits, review outbound connections.\n\n**Scenario 3: Insider Threat on Database Server**\nAnalyze the suspect user's bash_history for database dump commands, check for large tar\u002Fzip files in home directory or \u002Ftmp, examine scp\u002Frsync commands for data transfer, review cron jobs for automated exfiltration, check USB device logs.\n\n**Scenario 4: Crypto-Miner on Cloud Instance**\nCheck for high-CPU processes in \u002Fproc (live) or systemd service files, examine crontab entries for miner restart scripts, check \u002Ftmp for mining binaries, analyze network connections for mining pool communications, review authorized_keys for attacker access.\n\n## Output Format\n\n```\nLinux Forensics Summary:\n  System: webserver01 (Ubuntu 22.04 LTS)\n  Hostname: webserver01.corp.local\n  Kernel: 5.15.0-91-generic\n\n  User Accounts:\n    Total: 25 (3 with UID 0 - 1 ANOMALOUS)\n    Interactive shells: 8 users\n    Recently created: admin2 (created 2024-01-15)\n\n  Authentication Events:\n    Successful SSH logins: 456\n    Failed SSH attempts: 12,345 (from 23 unique IPs)\n    Sudo executions: 89\n\n  Persistence Mechanisms Found:\n    Cron jobs: 3 suspicious (reverse shell, miner restart)\n    Systemd services: 1 unknown (update-checker.service)\n    SSH keys: 2 unauthorized keys in root authorized_keys\n    rc.local: Modified with download cradle\n\n  Suspicious Activity:\n    - bash_history contains wget to pastebin URL\n    - SUID binary \u002Ftmp\u002F.hidden\u002Fescalate found\n    - \u002Fdev\u002Fshm\u002F contains compiled ELF binary\n    - LD_PRELOAD in \u002Fetc\u002Fld.so.preload pointing to \u002Flib\u002F.hidden.so\n\n  Report: \u002Fcases\u002Fcase-2024-001\u002Flinux\u002Fanalysis\u002F\n```\n",{"name":5,"domain":23,"description":7},"main","a91f1293287ffa9f4f1b8f486cd6e835a1568c84","skills\u002Flinux-log-sysartifacts-persist","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace","https:\u002F\u002Fgithub.com\u002FDCx7C5","#Python","2026-09-01 11:21:00",{"source":8,"skillName":5,"commands":37,"prompt":47,"zipAvailable":48},[38,41,44],{"tool":39,"command":40},"npx","npx skills add DCx7C5\u002Fai-marketplace --skill linux-log-sysartifacts-persist",{"tool":42,"command":43},"bunx","bunx skills add DCx7C5\u002Fai-marketplace --skill linux-log-sysartifacts-persist",{"tool":45,"command":46},"pnpm","pnpm dlx skills add DCx7C5\u002Fai-marketplace --skill linux-log-sysartifacts-persist","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Flinux-log-sysartifacts-persist\u002FSKILL.md",true,[50],{"path":51,"resourceType":52,"resourceTypeDesc":53,"sizeBytes":54,"sourceHtmlUrl":55},"index.json","REFERENCE","参考文档",520,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Flinux-log-sysartifacts-persist\u002Findex.json",[57,82,105,127,149,165],{"skillNo":58,"name":59,"nameZh":6,"description":60,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":61,"categories":62,"keywords":63,"publishedAt":24},"01M71HAPZ01KQ30RKTB0FFSQ05","services-wmi-persistence-detect","Detect WMI event subscription persistence by enumerating ActiveScriptEventConsumer, CommandLineEventConsumer, and permanent subscriptions in the WMI repository.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fpersistence\u002Fdetect\u002FSKILL.md",[],[64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,23,81],"services","detect","services wmi persistence detect","wmi","persistence","de","cm","process","activescript","event","subscriptions","commandline-consumer","repository","subscription","event-subscription","t1546.003","forensics","process-forensics",{"skillNo":83,"name":84,"nameZh":6,"description":85,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":86,"categories":87,"keywords":88,"publishedAt":24},"01M71HAK6JTTTS229T17WJMMCG","services-wmi-exec-exploit","Perform lateral movement across Windows networks using WMI-based remote execution techniques including Impacket wmiexec.py, CrackMapExec, and native WMI commands for stealthy post-exploitation during red team engagements.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fexec\u002Fexploit\u002FSKILL.md",[],[89,64,90,67,91,92,93,23,94,95,96,97,98,99,69,100,101,102,103,104],"exploit","services wmi exec exploit","exec","remote","traffic","Bash","analysis","team","across","crackmapexec","native","command","lateral movement","read","lateral-movement","Impacket",{"skillNo":106,"name":107,"nameZh":6,"description":108,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":109,"categories":110,"keywords":111,"publishedAt":24},"01M71HAG6MHKNQV8KDZKMT4886","registry-artifact-extract","Extract and analyze Windows Registry hives to uncover user activity, installed software, autostart entries, and evidence of system compromise.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fregistry\u002Fartifact\u002Fextract\u002FSKILL.md",[],[112,113,114,115,116,117,23,94,118,95,119,120,69,102,121,122,123,124,125,126],"artifact","registry","registry artifact extract","extract","evidence-collection","artifact-analysis","collection","analyze","uncover","software","activity","digital-forensics","windows-registry","regripper","sonnet",{"skillNo":128,"name":129,"nameZh":6,"description":130,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":131,"categories":132,"keywords":133,"publishedAt":24},"01M71HACR4A8XTWTTSXK4124AA","processes-token-impersonate-detect","Detect Windows token impersonation and privilege abuse including SeImpersonatePrivilege exploitation via Potato attacks and token stealing techniques.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Ftoken\u002Fimpersonate\u002Fdetect\u002FSKILL.md",[],[65,134,135,136,137,138,139,70,140,23,81,141,142,143,144,145,146,147,148,69],"processes token impersonate detect","token","processes","attacks","windows","escalation","techniques","privilege-escalation","seimpersonate","token-impersonation","printspoofer","exploitation","potato","impersonation","via",{"skillNo":150,"name":151,"nameZh":6,"description":152,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":153,"categories":154,"keywords":155,"publishedAt":24},"01M71HAABSB4Z6QFSXEG00R4RK","processes-thread-injection-detect","Detect Windows thread injection techniques including CreateRemoteThread, QueueUserAPC, NtCreateThreadEx, and thread hijacking via process memory analysis.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fthread\u002Finjection\u002Fdetect\u002FSKILL.md",[],[156,157,65,158,136,138,159,70,160,140,23,81,95,161,162,163,164,148,69,71],"thread","processes thread injection detect","injection","memory","process-injection","api","apc-injection","thread-injection","nt-api",{"skillNo":166,"name":167,"nameZh":6,"description":168,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":169,"categories":170,"keywords":171,"publishedAt":24},"01M71HA7H311V5G14WMX58HQSS","processes-hollow-technique-detect","Detect process hollowing (RunPE) by identifying processes with mismatched image paths between PEB and VAD tree, or unmapped PE headers in memory.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fhollow\u002Ftechnique\u002Fdetect\u002FSKILL.md",[],[172,65,136,173,159,70,174,175,23,81,176,177,178,179,180,181,69,71,182,183],"processes hollow technique detect","tree","memory-forensics","process-hollow","peb","runpe","image","pe-header","in memory","with","mismatched","headers"]