[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71ECYYMM417WK93GC31JNBC":3,"skill-same:01M71ECYYMM417WK93GC31JNBC":57},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":25,"linkOnly":26,"markdownContent":27,"markdownBody":28,"frontMatter":29,"refName":30,"commitSha":31,"skillDirectory":32,"forksCount":14,"repositoryHtmlUrl":33,"repositoryHomepageUrl":6,"ownerHtmlUrl":34,"ownerBlogUrl":6,"ownerDescription":35,"updatedAt":36,"install":37,"resources":50},"01M71ECYYMM417WK93GC31JNBC","linux-proc-binary-static-analyze",null,"Linux Proc Binary Static Analyze.","DCx7C5\u002Fai-marketplace","DCx7C5","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42419559?v=4","01M71C01G2AZV3NTNGWAWSHJPP","DC","01M71C01GQW6G50S2BYMS7PP3E",0,"MIT","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Flinux-proc-binary-static-analyze\u002FSKILL.md",[],[19,20,21,22,23,24],"linux","analyze","binary","static","linux proc binary static analyze","cybersecurity","2026-11-10 10:12:30",false,"---\nname: linux-proc-binary-static-analyze\ndescription: \"Linux Proc Binary Static Analyze.\"\ndomain: cybersecurity\n---\n\n|\n| **ELF (Executable and Linkable Format)** | Standard binary format for Linux executables, shared libraries, and core dumps containing headers, sections, and segments |\n| **Stripped Binary** | ELF binary with debug symbols removed, making reverse engineering more difficult as function names are lost |\n| **LD_PRELOAD** | Linux environment variable specifying shared libraries to load before all others; abused by rootkits to intercept system library calls |\n| **strace** | Linux system call tracer that logs all system calls and signals made by a process, revealing file, network, and process operations |\n| **GOT\u002FPLT** | Global Offset Table and Procedure Linkage Table; ELF structures for dynamic linking that can be hijacked for function hooking |\n| **Statically Linked** | Binary compiled with all library code included; common in IoT malware to run on systems without matching shared libraries |\n| **Mirai** | Prolific Linux botnet targeting IoT devices via telnet brute-force; source code leaked, leading to many variants |\n\n## Tools & Systems\n\n- **Ghidra**: NSA reverse engineering tool with full ELF support for x86, x86_64, ARM, MIPS, and other Linux architectures\n- **Radare2**: Open-source reverse engineering framework with command-line interface for quick binary analysis and scripting\n- **strace**: Linux system call tracing tool for observing binary behavior including file, network, and process operations\n- **GDB**: GNU Debugger for setting breakpoints, examining memory, and stepping through Linux binary execution\n- **pyelftools**: Python library for parsing ELF files programmatically for automated analysis pipelines\n\n## Common Scenarios\n\n### Scenario: Analyzing a Cryptominer Found on a Compromised Linux Server\n\n**Context**: A cloud server shows 100% CPU usage. Investigation reveals an unknown binary running from \u002Ftmp with a suspicious name. The binary needs analysis to confirm it is a cryptominer and identify the attacker's wallet and pool.\n\n**Approach**:\n1. Copy the binary to an analysis VM and compute SHA-256 hash\n2. Run `file` and `readelf` to identify architecture and linking type\n3. Extract strings and search for mining pool addresses (stratum+tcp:\u002F\u002F) and wallet addresses\n4. Run with strace in a sandbox to observe network connections (mining pool connection)\n5. Import into Ghidra to identify the mining algorithm and configuration extraction\n6. Check for persistence mechanisms (crontab, systemd service, SSH keys)\n7. Document all IOCs including pool address, wallet, C2 for updates, and persistence artifacts\n\n**Pitfalls**:\n- Running `ldd` on malware outside a sandbox (ldd can execute code in the binary)\n- Not checking for ARM\u002FMIPS architecture before attempting x86_64 execution\n- Missing companion scripts (.sh files) that may handle persistence and cleanup\n- Ignoring the initial access vector (how the miner was deployed: SSH brute force, web exploit, container escape)\n\n## Output Format\n\n```\nLINUX ELF MALWARE ANALYSIS REPORT\n====================================\nFile:             \u002Ftmp\u002F.X11-unix\u002F.rsync\nSHA-256:          e3b0c44298fc1c149afbf4c8996fb924...\nType:             ELF 64-bit LSB executable, x86-64\nLinking:          Statically linked (all libraries embedded)\nStripped:         Yes\nSize:             2,847,232 bytes\nPacker:           UPX 3.96 (unpacked for analysis)\n\nCLASSIFICATION\nFamily:           XMRig Cryptominer (modified)\nVariant:          Custom build with C2 update mechanism\n\nFUNCTIONALITY\n[*] XMR (Monero) mining via RandomX algorithm\n[*] Stratum pool connection for work submission\n[*] C2 check-in for configuration updates\n[*] Process name masquerading (argv[0] = \"[kworker\u002F0:0]\")\n[*] Competitor process killing (kills other miners)\n[*] SSH key injection for re-access\n\nNETWORK INDICATORS\nMining Pool:      stratum+tcp:\u002F\u002Fpool.minexmr[.]com:4444\nC2 Server:        hxxp:\u002F\u002Fupdate.malicious[.]com\u002Fconfig\nWallet:           49jZ5Q3b...Monero_Wallet_Address...\n\nPERSISTENCE\n[1] Crontab entry: *\u002F5 * * * * \u002Ftmp\u002F.X11-unix\u002F.rsync\n[2] SSH key added to \u002Froot\u002F.ssh\u002Fauthorized_keys\n[3] Systemd service: \u002Fetc\u002Fsystemd\u002Fsystem\u002Frsync-daemon.service\n[4] Modified \u002Fetc\u002Fld.so.preload for process hiding\n\nPROCESS HIDING\nLD_PRELOAD:       \u002Fusr\u002Flib\u002F.libsystem.so\nHook:             readdir() to hide \u002Ftmp\u002F.X11-unix\u002F.rsync from ls\nHook:             fopen() to hide from \u002Fproc\u002F*\u002Fmaps reading\n```\n","|\n| **ELF (Executable and Linkable Format)** | Standard binary format for Linux executables, shared libraries, and core dumps containing headers, sections, and segments |\n| **Stripped Binary** | ELF binary with debug symbols removed, making reverse engineering more difficult as function names are lost |\n| **LD_PRELOAD** | Linux environment variable specifying shared libraries to load before all others; abused by rootkits to intercept system library calls |\n| **strace** | Linux system call tracer that logs all system calls and signals made by a process, revealing file, network, and process operations |\n| **GOT\u002FPLT** | Global Offset Table and Procedure Linkage Table; ELF structures for dynamic linking that can be hijacked for function hooking |\n| **Statically Linked** | Binary compiled with all library code included; common in IoT malware to run on systems without matching shared libraries |\n| **Mirai** | Prolific Linux botnet targeting IoT devices via telnet brute-force; source code leaked, leading to many variants |\n\n## Tools & Systems\n\n- **Ghidra**: NSA reverse engineering tool with full ELF support for x86, x86_64, ARM, MIPS, and other Linux architectures\n- **Radare2**: Open-source reverse engineering framework with command-line interface for quick binary analysis and scripting\n- **strace**: Linux system call tracing tool for observing binary behavior including file, network, and process operations\n- **GDB**: GNU Debugger for setting breakpoints, examining memory, and stepping through Linux binary execution\n- **pyelftools**: Python library for parsing ELF files programmatically for automated analysis pipelines\n\n## Common Scenarios\n\n### Scenario: Analyzing a Cryptominer Found on a Compromised Linux Server\n\n**Context**: A cloud server shows 100% CPU usage. Investigation reveals an unknown binary running from \u002Ftmp with a suspicious name. The binary needs analysis to confirm it is a cryptominer and identify the attacker's wallet and pool.\n\n**Approach**:\n1. Copy the binary to an analysis VM and compute SHA-256 hash\n2. Run `file` and `readelf` to identify architecture and linking type\n3. Extract strings and search for mining pool addresses (stratum+tcp:\u002F\u002F) and wallet addresses\n4. Run with strace in a sandbox to observe network connections (mining pool connection)\n5. Import into Ghidra to identify the mining algorithm and configuration extraction\n6. Check for persistence mechanisms (crontab, systemd service, SSH keys)\n7. Document all IOCs including pool address, wallet, C2 for updates, and persistence artifacts\n\n**Pitfalls**:\n- Running `ldd` on malware outside a sandbox (ldd can execute code in the binary)\n- Not checking for ARM\u002FMIPS architecture before attempting x86_64 execution\n- Missing companion scripts (.sh files) that may handle persistence and cleanup\n- Ignoring the initial access vector (how the miner was deployed: SSH brute force, web exploit, container escape)\n\n## Output Format\n\n```\nLINUX ELF MALWARE ANALYSIS REPORT\n====================================\nFile:             \u002Ftmp\u002F.X11-unix\u002F.rsync\nSHA-256:          e3b0c44298fc1c149afbf4c8996fb924...\nType:             ELF 64-bit LSB executable, x86-64\nLinking:          Statically linked (all libraries embedded)\nStripped:         Yes\nSize:             2,847,232 bytes\nPacker:           UPX 3.96 (unpacked for analysis)\n\nCLASSIFICATION\nFamily:           XMRig Cryptominer (modified)\nVariant:          Custom build with C2 update mechanism\n\nFUNCTIONALITY\n[*] XMR (Monero) mining via RandomX algorithm\n[*] Stratum pool connection for work submission\n[*] C2 check-in for configuration updates\n[*] Process name masquerading (argv[0] = \"[kworker\u002F0:0]\")\n[*] Competitor process killing (kills other miners)\n[*] SSH key injection for re-access\n\nNETWORK INDICATORS\nMining Pool:      stratum+tcp:\u002F\u002Fpool.minexmr[.]com:4444\nC2 Server:        hxxp:\u002F\u002Fupdate.malicious[.]com\u002Fconfig\nWallet:           49jZ5Q3b...Monero_Wallet_Address...\n\nPERSISTENCE\n[1] Crontab entry: *\u002F5 * * * * \u002Ftmp\u002F.X11-unix\u002F.rsync\n[2] SSH key added to \u002Froot\u002F.ssh\u002Fauthorized_keys\n[3] Systemd service: \u002Fetc\u002Fsystemd\u002Fsystem\u002Frsync-daemon.service\n[4] Modified \u002Fetc\u002Fld.so.preload for process hiding\n\nPROCESS HIDING\nLD_PRELOAD:       \u002Fusr\u002Flib\u002F.libsystem.so\nHook:             readdir() to hide \u002Ftmp\u002F.X11-unix\u002F.rsync from ls\nHook:             fopen() to hide from \u002Fproc\u002F*\u002Fmaps reading\n```\n",{"name":5,"domain":24,"description":7},"main","a91f1293287ffa9f4f1b8f486cd6e835a1568c84","skills\u002Flinux-proc-binary-static-analyze","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace","https:\u002F\u002Fgithub.com\u002FDCx7C5","#Python","2026-09-01 11:21:00",{"source":8,"skillName":5,"commands":38,"prompt":48,"zipAvailable":49},[39,42,45],{"tool":40,"command":41},"npx","npx skills add DCx7C5\u002Fai-marketplace --skill linux-proc-binary-static-analyze",{"tool":43,"command":44},"bunx","bunx skills add DCx7C5\u002Fai-marketplace --skill linux-proc-binary-static-analyze",{"tool":46,"command":47},"pnpm","pnpm dlx skills add DCx7C5\u002Fai-marketplace --skill linux-proc-binary-static-analyze","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Flinux-proc-binary-static-analyze\u002FSKILL.md",true,[51],{"path":52,"resourceType":53,"resourceTypeDesc":54,"sizeBytes":55,"sourceHtmlUrl":56},"index.json","REFERENCE","参考文档",528,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Flinux-proc-binary-static-analyze\u002Findex.json",[58,83,106,127,149,165],{"skillNo":59,"name":60,"nameZh":6,"description":61,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":62,"categories":63,"keywords":64,"publishedAt":25},"01M71HAPZ01KQ30RKTB0FFSQ05","services-wmi-persistence-detect","Detect WMI event subscription persistence by enumerating ActiveScriptEventConsumer, CommandLineEventConsumer, and permanent subscriptions in the WMI repository.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fpersistence\u002Fdetect\u002FSKILL.md",[],[65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,24,82],"services","detect","services wmi persistence detect","wmi","persistence","de","cm","process","activescript","event","subscriptions","commandline-consumer","repository","subscription","event-subscription","t1546.003","forensics","process-forensics",{"skillNo":84,"name":85,"nameZh":6,"description":86,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":87,"categories":88,"keywords":89,"publishedAt":25},"01M71HAK6JTTTS229T17WJMMCG","services-wmi-exec-exploit","Perform lateral movement across Windows networks using WMI-based remote execution techniques including Impacket wmiexec.py, CrackMapExec, and native WMI commands for stealthy post-exploitation during red team engagements.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fexec\u002Fexploit\u002FSKILL.md",[],[90,65,91,68,92,93,94,24,95,96,97,98,99,100,70,101,102,103,104,105],"exploit","services wmi exec exploit","exec","remote","traffic","Bash","analysis","team","across","crackmapexec","native","command","lateral movement","read","lateral-movement","Impacket",{"skillNo":107,"name":108,"nameZh":6,"description":109,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":110,"categories":111,"keywords":112,"publishedAt":25},"01M71HAG6MHKNQV8KDZKMT4886","registry-artifact-extract","Extract and analyze Windows Registry hives to uncover user activity, installed software, autostart entries, and evidence of system compromise.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fregistry\u002Fartifact\u002Fextract\u002FSKILL.md",[],[113,114,115,116,117,118,24,95,119,96,20,120,70,103,121,122,123,124,125,126],"artifact","registry","registry artifact extract","extract","evidence-collection","artifact-analysis","collection","uncover","software","activity","digital-forensics","windows-registry","regripper","sonnet",{"skillNo":128,"name":129,"nameZh":6,"description":130,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":131,"categories":132,"keywords":133,"publishedAt":25},"01M71HACR4A8XTWTTSXK4124AA","processes-token-impersonate-detect","Detect Windows token impersonation and privilege abuse including SeImpersonatePrivilege exploitation via Potato attacks and token stealing techniques.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Ftoken\u002Fimpersonate\u002Fdetect\u002FSKILL.md",[],[66,134,135,136,137,138,139,71,140,24,82,141,142,143,144,145,146,147,148,70],"processes token impersonate detect","token","processes","attacks","windows","escalation","techniques","privilege-escalation","seimpersonate","token-impersonation","printspoofer","exploitation","potato","impersonation","via",{"skillNo":150,"name":151,"nameZh":6,"description":152,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":153,"categories":154,"keywords":155,"publishedAt":25},"01M71HAABSB4Z6QFSXEG00R4RK","processes-thread-injection-detect","Detect Windows thread injection techniques including CreateRemoteThread, QueueUserAPC, NtCreateThreadEx, and thread hijacking via process memory analysis.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fthread\u002Finjection\u002Fdetect\u002FSKILL.md",[],[156,157,66,158,136,138,159,71,160,140,24,82,96,161,162,163,164,148,70,72],"thread","processes thread injection detect","injection","memory","process-injection","api","apc-injection","thread-injection","nt-api",{"skillNo":166,"name":167,"nameZh":6,"description":168,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":169,"categories":170,"keywords":171,"publishedAt":25},"01M71HA7H311V5G14WMX58HQSS","processes-hollow-technique-detect","Detect process hollowing (RunPE) by identifying processes with mismatched image paths between PEB and VAD tree, or unmapped PE headers in memory.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fhollow\u002Ftechnique\u002Fdetect\u002FSKILL.md",[],[172,66,136,173,159,71,174,175,24,82,176,177,178,179,180,181,70,72,182,183],"processes hollow technique detect","tree","memory-forensics","process-hollow","peb","runpe","image","pe-header","in memory","with","mismatched","headers"]