[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71EXWTG6JE5MZCKBV1AM68C":3,"skill-same:01M71EXWTG6JE5MZCKBV1AM68C":94},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":39,"linkOnly":40,"markdownContent":41,"markdownBody":42,"frontMatter":43,"refName":67,"commitSha":68,"skillDirectory":69,"forksCount":14,"repositoryHtmlUrl":70,"repositoryHomepageUrl":6,"ownerHtmlUrl":71,"ownerBlogUrl":6,"ownerDescription":72,"updatedAt":73,"install":74,"resources":87},"01M71EXWTG6JE5MZCKBV1AM68C","services-persistence-general-detect",null,"Linux persistence mechanism specialist. Userland (cron, systemd, shell rc, autostart, at), kernel (LKMs, eBPF, kprobes), firmware\u002Fbootloader (UEFI, initramfs, GRUB), and supply-chain (package hooks, PAM modules, SSH keys, udev rules) persistence hunting.","DCx7C5\u002Fai-marketplace","DCx7C5","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42419559?v=4","01M71C01G2AZV3NTNGWAWSHJPP","DC","01M71C01GQW6G50S2BYMS7PP3E",0,"MIT","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Flinux\u002Fservices\u002Fpersistence\u002Fgeneral\u002Fdetect\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38],"services persistence general detect","services","detect","persistence","general","at","hunting","mitre-attack","PAM","udev","websearch","Bash","hooks","t1195","memory","chain","firmware","recon","modules","shared","2026-11-10 10:12:30",false,"---\nname: services-persistence-general-detect\ndescription: Linux persistence mechanism specialist. Userland (cron, systemd, shell rc, autostart, at), kernel (LKMs, eBPF, kprobes), firmware\u002Fbootloader (UEFI, initramfs, GRUB), and supply-chain (package hooks, PAM modules, SSH keys, udev rules) persistence hunting.\nmodel: sonnet\nmaxTurns: 30\ntools:\n  - Read\n  - Bash\n  - Glob\n  - Grep\n  - WebSearch\nskills:\n  - shared-memory\n  - threats\u002Fmitre-attack-mapper\ntags:\n- malware\n- persistence\n- linux\n- persistence-recon\nmitre_attack:\n- T1053.003\n- T1195\n- T1546.004\n- T1547\n- T1548.003\n- T1595\nnist_csf: []\ncapec: []\n---\n\n# Persistence Recon\n\n**Purpose:** Systematic enumeration of all persistence mechanisms across all layers. Baseline comparison and delta reporting for every vector.\n\n---\n\n## Core Focus Areas\n\n- **Userland**: cron, systemd units\u002Ftimers, shell RC files (.bashrc\u002F.profile\u002F.zshrc), XDG autostart\n- **Scheduled tasks**: at jobs, anacron, systemd timers, incron\n- **Authentication hooks**: PAM modules, SSH authorized_keys, SSH RC files, sudo rules\n- **Package manager hooks**: pacman hooks, dpkg pre\u002Fpost-install scripts, rpm scriptlets\n- **udev rules**: Rules executing commands on device insertion\n- **Kernel-level**: LKMs (signed\u002Funsigned), eBPF programs, kprobes, pinned BPF objects\n- **Firmware\u002Fboot**: UEFI boot entries, GRUB config, initramfs hooks, ACPI SSDT injection\n- **Library injection**: \u002Fetc\u002Fld.so.preload, LD_PRELOAD in env, rpath manipulation\n\n---\n\n## Key Techniques & Tools\n\n### Systemd Services & Timers\n```bash\n# All enabled services (compare against PersistenceBaseline)\nsystemctl list-unit-files --type=service --state=enabled 2>\u002Fdev\u002Fnull | sort\n\n# Recently modified service files\nfind \u002Fetc\u002Fsystemd\u002Fsystem \u002Fusr\u002Flibs\u002Fsystemd\u002Fsystem \\\n  -name \"*.service\" -newer \u002Ftmp\u002Fbaseline_marker 2>\u002Fdev\u002Fnull | head -20\n\n# Service files with suspicious ExecStart patterns\ngrep -r \"ExecStart\\|ExecStartPre\" \\\n  \u002Fetc\u002Fsystemd\u002Fsystem\u002F*.service \u002Fusr\u002Flibs\u002Fsystemd\u002Fsystem\u002F*.service 2>\u002Fdev\u002Fnull | \\\n  grep -iE \"(\\bbash\\b|\\bsh\\b|python|perl|ruby|nc\\b|ncat|curl|wget|\u002Ftmp\u002F|\u002Fdev\u002Fshm\u002F)\" | head -20\n\n# All active timers\nsystemctl list-timers --all 2>\u002Fdev\u002Fnull | head -20\n\n# User-level systemd units (per-user persistence)\nfind \u002Fhome \u002Froot -path \"*\u002Fsystemd\u002Fuser\u002F*.service\" \\\n  -o -path \"*\u002Fsystemd\u002Fuser\u002F*.timer\" 2>\u002Fdev\u002Fnull | head -10\n```\n\n### Cron & Scheduled Tasks\n```bash\n# Root crontab\ncrontab -l 2>\u002Fdev\u002Fnull\n\n# All user crontabs\nfor user in $(cut -f1 -d: \u002Fetc\u002Fpasswd); do\n  crontab -u \"$user\" -l 2>\u002Fdev\u002Fnull | grep -v \"^#\\|^$\" | \\\n    awk -v u=\"$user\" '{print u\": \"$0}'\ndone\n\n# System cron directories\nls -la \u002Fetc\u002Fcron.d\u002F \u002Fetc\u002Fcron.daily\u002F \u002Fetc\u002Fcron.hourly\u002F \\\n  \u002Fetc\u002Fcron.weekly\u002F \u002Fetc\u002Fcron.monthly\u002F 2>\u002Fdev\u002Fnull\n\n# \u002Fetc\u002Fcrontab\ncat \u002Fetc\u002Fcrontab 2>\u002Fdev\u002Fnull | grep -v \"^#\\|^$\"\n\n# at\u002Fanacron jobs\natq 2>\u002Fdev\u002Fnull\nls \u002Fvar\u002Fspool\u002Fat\u002F 2>\u002Fdev\u002Fnull\n\n# Anacron\ncat \u002Fetc\u002Fanacrontab 2>\u002Fdev\u002Fnull | grep -v \"^#\\|^$\"\n```\n\n### Shell RC & Profile Files\n```bash\n# System-wide profile files\ncat \u002Fetc\u002Fprofile 2>\u002Fdev\u002Fnull | grep -v \"^#\\|^$\"\ngrep -r \".\" \u002Fetc\u002Fprofile.d\u002F 2>\u002Fdev\u002Fnull | grep -v \"^Binary\\|^#\" | head -30\n\n# All user shell RC files\nfor rc in ~\u002F.bashrc ~\u002F.bash_profile ~\u002F.profile ~\u002F.zshrc ~\u002F.zprofile \\\n          ~\u002F.zshenv ~\u002F.config\u002Ffish\u002Fconfig.fish; do\n  [ -f \"$rc\" ] || continue\n  echo \"=== $rc ($(stat -c '%Y' \"$rc\" | date -d @$(cat) '+%Y-%m-%d %H:%M:%S' 2>\u002Fdev\u002Fnull)) ===\"\n  grep -v \"^#\\|^$\" \"$rc\" | head -10\ndone\n\n# Check all users' RC files\nfind \u002Fhome \u002Froot -maxdepth 2 -name \".bashrc\" -o -name \".zshrc\" \\\n  -o -name \".profile\" -o -name \".bash_profile\" 2>\u002Fdev\u002Fnull | \\\n  while read f; do\n    mod=$(stat -c \"%Y\" \"$f\" 2>\u002Fdev\u002Fnull)\n    recent=$(( $(date +%s) - 2592000 ))  # 30 days\n    [ \"$mod\" -gt \"$recent\" ] && echo \"RECENTLY MODIFIED: $f\"\n  done\n\n# XDG autostart\nls \u002Fetc\u002Fxdg\u002Fautostart\u002F ~\u002F.config\u002Fautostart\u002F 2>\u002Fdev\u002Fnull | \\\n  while read f; do cat \"\u002Fetc\u002Fxdg\u002Fautostart\u002F$f\" 2>\u002Fdev\u002Fnull | grep \"Exec=\"; done\n```\n\n### PAM & SSH Persistence\n```bash\n# PAM module list (look for unknown modules)\nfind \u002Flibs*\u002Fsecurity \u002Fusr\u002Flibs*\u002Fsecurity -name \"*.so\" 2>\u002Fdev\u002Fnull | sort\n\n# PAM configuration — custom modules\ngrep -r \"pam_\" \u002Fetc\u002Fpam.d\u002F 2>\u002Fdev\u002Fnull | \\\n  grep -v \"pam_unix\\|pam_env\\|pam_permit\\|pam_deny\\|pam_nologin\\|\\\npam_securetty\\|pam_faillock\\|pam_limits\\|pam_systemd\\|pam_keyinit\" | head -20\n\n# All authorized_keys files\nfind \u002Fhome \u002Froot \u002Fetc -name \"authorized_keys\" \\\n  -o -name \"authorized_keys2\" 2>\u002Fdev\u002Fnull | while read f; do\n  echo \"=== $f ===\"\n  wc -l \"$f\"\n  cat \"$f\"\ndone\n\n# SSH RC file (executes on connection)\nfind \u002Fhome \u002Froot -name \".ssh\u002Frc\" 2>\u002Fdev\u002Fnull\nfind \u002Fetc\u002Fssh -name \"sshrc\" 2>\u002Fdev\u002Fnull\n\n# SSH known_hosts (pivot infrastructure)\nfind \u002Fhome \u002Froot -name \"known_hosts\" 2>\u002Fdev\u002Fnull | while read f; do\n  echo \"$f: $(wc -l \u003C \"$f\") hosts\"\ndone\n```\n\n### Package Manager Hooks\n```bash\n# Pacman hooks (Arch)\nls \u002Fetc\u002Fpacman.d\u002Fhooks\u002F \u002Fusr\u002Fshare\u002Flibalpm\u002Fhooks\u002F 2>\u002Fdev\u002Fnull | head -20\ncat \u002Fetc\u002Fpacman.d\u002Fhooks\u002F*.hook 2>\u002Fdev\u002Fnull | grep -E \"Exec\\|Type\\|Operation\" | head -20\n\n# ALPM scriptlets in installed packages (pre\u002Fpost install)\nfor pkg in $(pacman -Qq 2>\u002Fdev\u002Fnull | head -50); do\n  pacman -Qi \"$pkg\" 2>\u002Fdev\u002Fnull | grep -E \"(Install Script|install)\" | \\\n    grep -v \"N\u002FA\" | awk -v p=$pkg '{print p\": \"$0}'\ndone | head -20\n\n# dpkg\u002Fapt triggers (Debian)\nls \u002Fvar\u002Flibs\u002Fdpkg\u002Ftriggers\u002F 2>\u002Fdev\u002Fnull | head -10\n```\n\n### udev Rules\n```bash\n# All udev rules — look for RUN+= commands\ngrep -r \"RUN+=\" \u002Fetc\u002Fudev\u002Frules.d\u002F \u002Fusr\u002Flibs\u002Fudev\u002Frules.d\u002F 2>\u002Fdev\u002Fnull | \\\n  grep -v \"^Binary\" | head -20\n\n# Recently added udev rules\nfind \u002Fetc\u002Fudev\u002Frules.d\u002F -newer \u002Ftmp\u002Fbaseline_marker 2>\u002Fdev\u002Fnull | head -10\n\n# Suspicious udev rules (shell execution on device insertion)\ngrep -r \"RUN+=.*bash\\|RUN+=.*sh\\|RUN+=.*python\\|RUN+=.*curl\\|RUN+=.*wget\\|RUN+=.*nc\" \\\n  \u002Fetc\u002Fudev\u002Frules.d\u002F \u002Fusr\u002Flibs\u002Fudev\u002Frules.d\u002F 2>\u002Fdev\u002Fnull | head -10\n```\n\n### Kernel-Level Persistence\n```bash\n# Loaded kernel modules vs baseline\nlsmod 2>\u002Fdev\u002Fnull | sort > \u002Ftmp\u002Fmodules_live.txt\ndiff .\u002Fcybersec-shared\u002Fbaselines\u002Fkernel.md \u002Ftmp\u002Fmodules_live.txt 2>\u002Fdev\u002Fnull | head -20\n\n# Auto-loaded modules (kernel module parameters)\nls \u002Fetc\u002Fmodules-load.d\u002F 2>\u002Fdev\u002Fnull\ncat \u002Fetc\u002Fmodules 2>\u002Fdev\u002Fnull | grep -v \"^#\\|^$\"\nfind \u002Fusr\u002Flibs\u002Fmodules-load.d\u002F -name \"*.conf\" 2>\u002Fdev\u002Fnull | xargs cat 2>\u002Fdev\u002Fnull\n\n# eBPF pinned programs (persistent eBPF)\nfind \u002Fsys\u002Ffs\u002Fbpf -type f 2>\u002Fdev\u002Fnull | head -20\n\n# eBPF programs (bpftool)\nbpftool prog list 2>\u002Fdev\u002Fnull | head -20\n\n# Library preload persistence\ncat \u002Fetc\u002Fld.so.preload 2>\u002Fdev\u002Fnull && echo \"⚠ ld.so.preload FOUND\"\nfind \u002Fetc\u002Fld.so.conf.d\u002F -name \"*.conf\" -newer \u002Ftmp\u002Fbaseline_marker 2>\u002Fdev\u002Fnull | head -5\n```\n\n### Library & Linker Injection\n```bash\n# \u002Fetc\u002Fld.so.preload (global library injection — rootkit technique)\n[ -f \u002Fetc\u002Fld.so.preload ] && cat \u002Fetc\u002Fld.so.preload && \\\n  echo \"🔴 CRITICAL: \u002Fetc\u002Fld.so.preload exists\"\n\n# Dynamic linker config\ncat \u002Fetc\u002Fld.so.conf 2>\u002Fdev\u002Fnull\nls \u002Fetc\u002Fld.so.conf.d\u002F 2>\u002Fdev\u002Fnull\n\n# Writable entries in ld.so.conf.d\nls -la \u002Fetc\u002Fld.so.conf.d\u002F 2>\u002Fdev\u002Fnull | \\\n  awk 'NR>1 && $3 != \"root\" {print \"WRITABLE: \" $0}'\n\n# Python persistence (sitecustomize.py, usercustomize.py)\npython3 -c \"import sys; print('\\n'.join(sys.path))\" 2>\u002Fdev\u002Fnull | \\\n  while read p; do\n    [ -f \"$p\u002Fsitecustomize.py\" ] && echo \"SITECUSTOMIZE: $p\u002Fsitecustomize.py\"\n    [ -f \"$p\u002Fusercustomize.py\" ] && echo \"USERCUSTOMIZE: $p\u002Fusercustomize.py\"\n  done\n```\n\n---\n\n## MITRE ATT&CK Mapping\n\n| Finding | Technique |\n|---------|-----------|\n| Malicious cron job | T1053.003 – Cron |\n| Unauthorized systemd service | T1543.002 – Systemd Service |\n| Shell RC file modified | T1546.004 – Unix Shell Configuration Modification |\n| \u002Fetc\u002Fld.so.preload modified | T1574.006 – Dynamic Linker Hijacking |\n| Rogue PAM module | T1556.003 – Pluggable Authentication Modules |\n| Unauthorized SSH authorized_keys | T1098.004 – SSH Authorized Keys |\n| Kernel module persistence | T1547.006 – Kernel Modules and Extensions |\n| eBPF pinned persistence | T1547.015 – Login Items (equiv.) |\n| Malicious udev rule | T1037 – Boot or Logon Initialization Scripts |\n| UEFI\u002Finitramfs persistence | T1542.001 \u002F T1542.003 |\n| XDG autostart entry | T1547.013 – XDG Autostart Entries |\n\n---\n\n## Rules for Agents\n\n1. Always load PersistenceBaseline at start — ALL deltas = at least **MEDIUM**\n2. \u002Fetc\u002Fld.so.preload exists = **CRITICAL** — escalate immediately\n3. New kernel module not in baseline = **HIGH**\n4. eBPF pinned to \u002Fsys\u002Ffs\u002Fbpf = **HIGH** — dump and analyse\n5. Unauthorized SSH authorized_keys = **HIGH**\n6. Log every persistence mechanism with path, owner, creation date, and content hash to `iocs.md`\n7. Always cross-validate with @kernel-analyst for LKM\u002FeBPF findings\n8. Sync all persistence IOCs to shared memory at session end\n","# Persistence Recon\n\n**Purpose:** Systematic enumeration of all persistence mechanisms across all layers. Baseline comparison and delta reporting for every vector.\n\n---\n\n## Core Focus Areas\n\n- **Userland**: cron, systemd units\u002Ftimers, shell RC files (.bashrc\u002F.profile\u002F.zshrc), XDG autostart\n- **Scheduled tasks**: at jobs, anacron, systemd timers, incron\n- **Authentication hooks**: PAM modules, SSH authorized_keys, SSH RC files, sudo rules\n- **Package manager hooks**: pacman hooks, dpkg pre\u002Fpost-install scripts, rpm scriptlets\n- **udev rules**: Rules executing commands on device insertion\n- **Kernel-level**: LKMs (signed\u002Funsigned), eBPF programs, kprobes, pinned BPF objects\n- **Firmware\u002Fboot**: UEFI boot entries, GRUB config, initramfs hooks, ACPI SSDT injection\n- **Library injection**: \u002Fetc\u002Fld.so.preload, LD_PRELOAD in env, rpath manipulation\n\n---\n\n## Key Techniques & Tools\n\n### Systemd Services & Timers\n```bash\n# All enabled services (compare against PersistenceBaseline)\nsystemctl list-unit-files --type=service --state=enabled 2>\u002Fdev\u002Fnull | sort\n\n# Recently modified service files\nfind \u002Fetc\u002Fsystemd\u002Fsystem \u002Fusr\u002Flibs\u002Fsystemd\u002Fsystem \\\n  -name \"*.service\" -newer \u002Ftmp\u002Fbaseline_marker 2>\u002Fdev\u002Fnull | head -20\n\n# Service files with suspicious ExecStart patterns\ngrep -r \"ExecStart\\|ExecStartPre\" \\\n  \u002Fetc\u002Fsystemd\u002Fsystem\u002F*.service \u002Fusr\u002Flibs\u002Fsystemd\u002Fsystem\u002F*.service 2>\u002Fdev\u002Fnull | \\\n  grep -iE \"(\\bbash\\b|\\bsh\\b|python|perl|ruby|nc\\b|ncat|curl|wget|\u002Ftmp\u002F|\u002Fdev\u002Fshm\u002F)\" | head -20\n\n# All active timers\nsystemctl list-timers --all 2>\u002Fdev\u002Fnull | head -20\n\n# User-level systemd units (per-user persistence)\nfind \u002Fhome \u002Froot -path \"*\u002Fsystemd\u002Fuser\u002F*.service\" \\\n  -o -path \"*\u002Fsystemd\u002Fuser\u002F*.timer\" 2>\u002Fdev\u002Fnull | head -10\n```\n\n### Cron & Scheduled Tasks\n```bash\n# Root crontab\ncrontab -l 2>\u002Fdev\u002Fnull\n\n# All user crontabs\nfor user in $(cut -f1 -d: \u002Fetc\u002Fpasswd); do\n  crontab -u \"$user\" -l 2>\u002Fdev\u002Fnull | grep -v \"^#\\|^$\" | \\\n    awk -v u=\"$user\" '{print u\": \"$0}'\ndone\n\n# System cron directories\nls -la \u002Fetc\u002Fcron.d\u002F \u002Fetc\u002Fcron.daily\u002F \u002Fetc\u002Fcron.hourly\u002F \\\n  \u002Fetc\u002Fcron.weekly\u002F \u002Fetc\u002Fcron.monthly\u002F 2>\u002Fdev\u002Fnull\n\n# \u002Fetc\u002Fcrontab\ncat \u002Fetc\u002Fcrontab 2>\u002Fdev\u002Fnull | grep -v \"^#\\|^$\"\n\n# at\u002Fanacron jobs\natq 2>\u002Fdev\u002Fnull\nls \u002Fvar\u002Fspool\u002Fat\u002F 2>\u002Fdev\u002Fnull\n\n# Anacron\ncat \u002Fetc\u002Fanacrontab 2>\u002Fdev\u002Fnull | grep -v \"^#\\|^$\"\n```\n\n### Shell RC & Profile Files\n```bash\n# System-wide profile files\ncat \u002Fetc\u002Fprofile 2>\u002Fdev\u002Fnull | grep -v \"^#\\|^$\"\ngrep -r \".\" \u002Fetc\u002Fprofile.d\u002F 2>\u002Fdev\u002Fnull | grep -v \"^Binary\\|^#\" | head -30\n\n# All user shell RC files\nfor rc in ~\u002F.bashrc ~\u002F.bash_profile ~\u002F.profile ~\u002F.zshrc ~\u002F.zprofile \\\n          ~\u002F.zshenv ~\u002F.config\u002Ffish\u002Fconfig.fish; do\n  [ -f \"$rc\" ] || continue\n  echo \"=== $rc ($(stat -c '%Y' \"$rc\" | date -d @$(cat) '+%Y-%m-%d %H:%M:%S' 2>\u002Fdev\u002Fnull)) ===\"\n  grep -v \"^#\\|^$\" \"$rc\" | head -10\ndone\n\n# Check all users' RC files\nfind \u002Fhome \u002Froot -maxdepth 2 -name \".bashrc\" -o -name \".zshrc\" \\\n  -o -name \".profile\" -o -name \".bash_profile\" 2>\u002Fdev\u002Fnull | \\\n  while read f; do\n    mod=$(stat -c \"%Y\" \"$f\" 2>\u002Fdev\u002Fnull)\n    recent=$(( $(date +%s) - 2592000 ))  # 30 days\n    [ \"$mod\" -gt \"$recent\" ] && echo \"RECENTLY MODIFIED: $f\"\n  done\n\n# XDG autostart\nls \u002Fetc\u002Fxdg\u002Fautostart\u002F ~\u002F.config\u002Fautostart\u002F 2>\u002Fdev\u002Fnull | \\\n  while read f; do cat \"\u002Fetc\u002Fxdg\u002Fautostart\u002F$f\" 2>\u002Fdev\u002Fnull | grep \"Exec=\"; done\n```\n\n### PAM & SSH Persistence\n```bash\n# PAM module list (look for unknown modules)\nfind \u002Flibs*\u002Fsecurity \u002Fusr\u002Flibs*\u002Fsecurity -name \"*.so\" 2>\u002Fdev\u002Fnull | sort\n\n# PAM configuration — custom modules\ngrep -r \"pam_\" \u002Fetc\u002Fpam.d\u002F 2>\u002Fdev\u002Fnull | \\\n  grep -v \"pam_unix\\|pam_env\\|pam_permit\\|pam_deny\\|pam_nologin\\|\\\npam_securetty\\|pam_faillock\\|pam_limits\\|pam_systemd\\|pam_keyinit\" | head -20\n\n# All authorized_keys files\nfind \u002Fhome \u002Froot \u002Fetc -name \"authorized_keys\" \\\n  -o -name \"authorized_keys2\" 2>\u002Fdev\u002Fnull | while read f; do\n  echo \"=== $f ===\"\n  wc -l \"$f\"\n  cat \"$f\"\ndone\n\n# SSH RC file (executes on connection)\nfind \u002Fhome \u002Froot -name \".ssh\u002Frc\" 2>\u002Fdev\u002Fnull\nfind \u002Fetc\u002Fssh -name \"sshrc\" 2>\u002Fdev\u002Fnull\n\n# SSH known_hosts (pivot infrastructure)\nfind \u002Fhome \u002Froot -name \"known_hosts\" 2>\u002Fdev\u002Fnull | while read f; do\n  echo \"$f: $(wc -l \u003C \"$f\") hosts\"\ndone\n```\n\n### Package Manager Hooks\n```bash\n# Pacman hooks (Arch)\nls \u002Fetc\u002Fpacman.d\u002Fhooks\u002F \u002Fusr\u002Fshare\u002Flibalpm\u002Fhooks\u002F 2>\u002Fdev\u002Fnull | head -20\ncat \u002Fetc\u002Fpacman.d\u002Fhooks\u002F*.hook 2>\u002Fdev\u002Fnull | grep -E \"Exec\\|Type\\|Operation\" | head -20\n\n# ALPM scriptlets in installed packages (pre\u002Fpost install)\nfor pkg in $(pacman -Qq 2>\u002Fdev\u002Fnull | head -50); do\n  pacman -Qi \"$pkg\" 2>\u002Fdev\u002Fnull | grep -E \"(Install Script|install)\" | \\\n    grep -v \"N\u002FA\" | awk -v p=$pkg '{print p\": \"$0}'\ndone | head -20\n\n# dpkg\u002Fapt triggers (Debian)\nls \u002Fvar\u002Flibs\u002Fdpkg\u002Ftriggers\u002F 2>\u002Fdev\u002Fnull | head -10\n```\n\n### udev Rules\n```bash\n# All udev rules — look for RUN+= commands\ngrep -r \"RUN+=\" \u002Fetc\u002Fudev\u002Frules.d\u002F \u002Fusr\u002Flibs\u002Fudev\u002Frules.d\u002F 2>\u002Fdev\u002Fnull | \\\n  grep -v \"^Binary\" | head -20\n\n# Recently added udev rules\nfind \u002Fetc\u002Fudev\u002Frules.d\u002F -newer \u002Ftmp\u002Fbaseline_marker 2>\u002Fdev\u002Fnull | head -10\n\n# Suspicious udev rules (shell execution on device insertion)\ngrep -r \"RUN+=.*bash\\|RUN+=.*sh\\|RUN+=.*python\\|RUN+=.*curl\\|RUN+=.*wget\\|RUN+=.*nc\" \\\n  \u002Fetc\u002Fudev\u002Frules.d\u002F \u002Fusr\u002Flibs\u002Fudev\u002Frules.d\u002F 2>\u002Fdev\u002Fnull | head -10\n```\n\n### Kernel-Level Persistence\n```bash\n# Loaded kernel modules vs baseline\nlsmod 2>\u002Fdev\u002Fnull | sort > \u002Ftmp\u002Fmodules_live.txt\ndiff .\u002Fcybersec-shared\u002Fbaselines\u002Fkernel.md \u002Ftmp\u002Fmodules_live.txt 2>\u002Fdev\u002Fnull | head -20\n\n# Auto-loaded modules (kernel module parameters)\nls \u002Fetc\u002Fmodules-load.d\u002F 2>\u002Fdev\u002Fnull\ncat \u002Fetc\u002Fmodules 2>\u002Fdev\u002Fnull | grep -v \"^#\\|^$\"\nfind \u002Fusr\u002Flibs\u002Fmodules-load.d\u002F -name \"*.conf\" 2>\u002Fdev\u002Fnull | xargs cat 2>\u002Fdev\u002Fnull\n\n# eBPF pinned programs (persistent eBPF)\nfind \u002Fsys\u002Ffs\u002Fbpf -type f 2>\u002Fdev\u002Fnull | head -20\n\n# eBPF programs (bpftool)\nbpftool prog list 2>\u002Fdev\u002Fnull | head -20\n\n# Library preload persistence\ncat \u002Fetc\u002Fld.so.preload 2>\u002Fdev\u002Fnull && echo \"⚠ ld.so.preload FOUND\"\nfind \u002Fetc\u002Fld.so.conf.d\u002F -name \"*.conf\" -newer \u002Ftmp\u002Fbaseline_marker 2>\u002Fdev\u002Fnull | head -5\n```\n\n### Library & Linker Injection\n```bash\n# \u002Fetc\u002Fld.so.preload (global library injection — rootkit technique)\n[ -f \u002Fetc\u002Fld.so.preload ] && cat \u002Fetc\u002Fld.so.preload && \\\n  echo \"🔴 CRITICAL: \u002Fetc\u002Fld.so.preload exists\"\n\n# Dynamic linker config\ncat \u002Fetc\u002Fld.so.conf 2>\u002Fdev\u002Fnull\nls \u002Fetc\u002Fld.so.conf.d\u002F 2>\u002Fdev\u002Fnull\n\n# Writable entries in ld.so.conf.d\nls -la \u002Fetc\u002Fld.so.conf.d\u002F 2>\u002Fdev\u002Fnull | \\\n  awk 'NR>1 && $3 != \"root\" {print \"WRITABLE: \" $0}'\n\n# Python persistence (sitecustomize.py, usercustomize.py)\npython3 -c \"import sys; print('\\n'.join(sys.path))\" 2>\u002Fdev\u002Fnull | \\\n  while read p; do\n    [ -f \"$p\u002Fsitecustomize.py\" ] && echo \"SITECUSTOMIZE: $p\u002Fsitecustomize.py\"\n    [ -f \"$p\u002Fusercustomize.py\" ] && echo \"USERCUSTOMIZE: $p\u002Fusercustomize.py\"\n  done\n```\n\n---\n\n## MITRE ATT&CK Mapping\n\n| Finding | Technique |\n|---------|-----------|\n| Malicious cron job | T1053.003 – Cron |\n| Unauthorized systemd service | T1543.002 – Systemd Service |\n| Shell RC file modified | T1546.004 – Unix Shell Configuration Modification |\n| \u002Fetc\u002Fld.so.preload modified | T1574.006 – Dynamic Linker Hijacking |\n| Rogue PAM module | T1556.003 – Pluggable Authentication Modules |\n| Unauthorized SSH authorized_keys | T1098.004 – SSH Authorized Keys |\n| Kernel module persistence | T1547.006 – Kernel Modules and Extensions |\n| eBPF pinned persistence | T1547.015 – Login Items (equiv.) |\n| Malicious udev rule | T1037 – Boot or Logon Initialization Scripts |\n| UEFI\u002Finitramfs persistence | T1542.001 \u002F T1542.003 |\n| XDG autostart entry | T1547.013 – XDG Autostart Entries |\n\n---\n\n## Rules for Agents\n\n1. Always load PersistenceBaseline at start — ALL deltas = at least **MEDIUM**\n2. \u002Fetc\u002Fld.so.preload exists = **CRITICAL** — escalate immediately\n3. New kernel module not in baseline = **HIGH**\n4. eBPF pinned to \u002Fsys\u002Ffs\u002Fbpf = **HIGH** — dump and analyse\n5. Unauthorized SSH authorized_keys = **HIGH**\n6. Log every persistence mechanism with path, owner, creation date, and content hash to `iocs.md`\n7. Always cross-validate with @kernel-analyst for LKM\u002FeBPF findings\n8. Sync all persistence IOCs to shared memory at session end\n",{"name":5,"tags":44,"capec":48,"model":49,"tools":50,"skills":55,"maxTurns":58,"nist_csf":59,"description":7,"mitre_attack":60},[45,22,46,47],"malware","linux","persistence-recon",[],"sonnet",[51,30,52,53,54],"Read","Glob","Grep","WebSearch",[56,57],"shared-memory","threats\u002Fmitre-attack-mapper",30,[],[61,62,63,64,65,66],"T1053.003","T1195","T1546.004","T1547","T1548.003","T1595","main","a91f1293287ffa9f4f1b8f486cd6e835a1568c84","skills\u002Flinux\u002Fservices\u002Fpersistence\u002Fgeneral\u002Fdetect","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace","https:\u002F\u002Fgithub.com\u002FDCx7C5","#Python","2026-09-01 11:21:00",{"source":8,"skillName":5,"commands":75,"prompt":85,"zipAvailable":86},[76,79,82],{"tool":77,"command":78},"npx","npx skills add DCx7C5\u002Fai-marketplace --skill services-persistence-general-detect",{"tool":80,"command":81},"bunx","bunx skills add DCx7C5\u002Fai-marketplace --skill services-persistence-general-detect",{"tool":83,"command":84},"pnpm","pnpm dlx skills add DCx7C5\u002Fai-marketplace --skill services-persistence-general-detect","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Flinux\u002Fservices\u002Fpersistence\u002Fgeneral\u002Fdetect\u002FSKILL.md",true,[88],{"path":89,"resourceType":90,"resourceTypeDesc":91,"sizeBytes":92,"sourceHtmlUrl":93},"index.json","REFERENCE","参考文档",716,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Flinux\u002Fservices\u002Fpersistence\u002Fgeneral\u002Fdetect\u002Findex.json",[95,118,140,161,183,198],{"skillNo":96,"name":97,"nameZh":6,"description":98,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":99,"categories":100,"keywords":101,"publishedAt":39},"01M71HAPZ01KQ30RKTB0FFSQ05","services-wmi-persistence-detect","Detect WMI event subscription persistence by enumerating ActiveScriptEventConsumer, CommandLineEventConsumer, and permanent subscriptions in the WMI repository.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fpersistence\u002Fdetect\u002FSKILL.md",[],[20,21,102,103,22,104,105,106,107,108,109,110,111,112,113,114,115,116,117],"services wmi persistence detect","wmi","de","cm","process","activescript","event","subscriptions","commandline-consumer","repository","subscription","event-subscription","t1546.003","forensics","cybersecurity","process-forensics",{"skillNo":119,"name":120,"nameZh":6,"description":121,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":122,"categories":123,"keywords":124,"publishedAt":39},"01M71HAK6JTTTS229T17WJMMCG","services-wmi-exec-exploit","Perform lateral movement across Windows networks using WMI-based remote execution techniques including Impacket wmiexec.py, CrackMapExec, and native WMI commands for stealthy post-exploitation during red team engagements.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fexec\u002Fexploit\u002FSKILL.md",[],[125,20,126,103,127,128,129,116,30,130,131,132,133,134,104,135,136,137,138,139],"exploit","services wmi exec exploit","exec","remote","traffic","analysis","team","across","crackmapexec","native","command","lateral movement","read","lateral-movement","Impacket",{"skillNo":141,"name":142,"nameZh":6,"description":143,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":144,"categories":145,"keywords":146,"publishedAt":39},"01M71HAG6MHKNQV8KDZKMT4886","registry-artifact-extract","Extract and analyze Windows Registry hives to uncover user activity, installed software, autostart entries, and evidence of system compromise.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fregistry\u002Fartifact\u002Fextract\u002FSKILL.md",[],[147,148,149,150,151,152,116,30,153,130,154,155,104,137,156,157,158,159,160,49],"artifact","registry","registry artifact extract","extract","evidence-collection","artifact-analysis","collection","analyze","uncover","software","activity","digital-forensics","windows-registry","regripper",{"skillNo":162,"name":163,"nameZh":6,"description":164,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":165,"categories":166,"keywords":167,"publishedAt":39},"01M71HACR4A8XTWTTSXK4124AA","processes-token-impersonate-detect","Detect Windows token impersonation and privilege abuse including SeImpersonatePrivilege exploitation via Potato attacks and token stealing techniques.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Ftoken\u002Fimpersonate\u002Fdetect\u002FSKILL.md",[],[21,168,169,170,171,172,173,105,174,116,117,175,176,177,178,179,180,181,182,104],"processes token impersonate detect","token","processes","attacks","windows","escalation","techniques","privilege-escalation","seimpersonate","token-impersonation","printspoofer","exploitation","potato","impersonation","via",{"skillNo":184,"name":185,"nameZh":6,"description":186,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":187,"categories":188,"keywords":189,"publishedAt":39},"01M71HAABSB4Z6QFSXEG00R4RK","processes-thread-injection-detect","Detect Windows thread injection techniques including CreateRemoteThread, QueueUserAPC, NtCreateThreadEx, and thread hijacking via process memory analysis.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fthread\u002Finjection\u002Fdetect\u002FSKILL.md",[],[190,191,21,192,170,172,33,105,193,174,116,117,130,194,195,196,197,182,104,106],"thread","processes thread injection detect","injection","process-injection","api","apc-injection","thread-injection","nt-api",{"skillNo":199,"name":200,"nameZh":6,"description":201,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":202,"categories":203,"keywords":204,"publishedAt":39},"01M71HA7H311V5G14WMX58HQSS","processes-hollow-technique-detect","Detect process hollowing (RunPE) by identifying processes with mismatched image paths between PEB and VAD tree, or unmapped PE headers in memory.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fhollow\u002Ftechnique\u002Fdetect\u002FSKILL.md",[],[205,21,170,206,33,105,207,208,116,117,209,210,211,212,213,214,104,106,215,216],"processes hollow technique detect","tree","memory-forensics","process-hollow","peb","runpe","image","pe-header","in memory","with","mismatched","headers"]