Linux Persistence Analyzer
Scans a Linux host for backdoor persistence (cron, systemd, LD_PRELOAD, shell profiles, SSH keys) and builds an installation timeline.
- Repository
- mukul975/Anthropic-Cybersecurity-Skills
- Stars
- 35,430
- Licence
- Apache-2.0
- Files
- 3 files
What it does
When installed, the agent gains a structured procedure for hunting how an attacker kept access to a compromised Linux machine. It checks scheduled jobs, system services, library preload settings, login shell profiles and SSH authorized keys for suspicious entries, then cross-references file changes with audit logs to estimate when each persistence method was installed. It produces a risk-scored report with remediation commands.
Great for
- Incident responders investigating a suspected compromise of a Linux server
- SOC analysts or threat hunters validating persistence detection coverage
- Security students learning MITRE ATT&CK persistence techniques on a lab or forensic image
Skip it if
- Ordinary users or sysadmins without a security incident: the output can be noisy and misread without expert review; false positives are likely since legitimate cron jobs and profiles are common
- Running against production systems without authorization or change control: it requires root or sudo and reads sensitive system locations
- Non-Linux systems (macOS, Windows): the paths and tools target Linux only
Try asking
- “Analyze this Linux host for persistence mechanisms and map them to MITRE ATT&CK techniques”
- “Check /etc/ld.so.preload and authorized_keys files for signs of backdoors on this server”
- “Build an installation timeline of suspicious cron and systemd entries from auditd logs”
- “Generate a risk-scored persistence report with remediation commands for a compromised host”
Install in 3 steps
- 1
Download the skill
The ZIP contains the 3 original files, the Apache-2.0 licence and an attribution note.
analyzing-persistence-mechanisms-in-linux.zip - 2
Add it to your agent
Claude Code (all projects)
mkdir -p ~/.claude/skills && unzip analyzing-persistence-mechanisms-in-linux.zip -d ~/.claude/skills/Claude Code / Agent SDK (this project only)
mkdir -p .claude/skills && unzip analyzing-persistence-mechanisms-in-linux.zip -d .claude/skills/Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.
- 3
Ask for the task
No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.
Get better results
- Run it on a forensic copy or isolated host first, and review the script before executing it with root privileges
- Enable auditd file watch rules before an incident so the timeline correlation has data to work with
- Treat flagged entries as leads to verify manually, since legitimate software also uses cron, systemd and profile files
What's inside
- references/api-reference.md
- scripts/agent.py
- SKILL.md
Redistributed unmodified from mukul975/Anthropic-Cybersecurity-Skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.