Back to Details

analyzing-persistence-mechanisms-in-linux

Compare original and translation side by side

🇺🇸

Original

English
🇨🇳

Translation

Chinese

Analyzing Persistence Mechanisms in Linux

分析Linux中的持久化机制

Overview

概述

Adversaries establish persistence on Linux systems through crontab jobs, systemd service/timer units, LD_PRELOAD library injection, shell profile modifications (.bashrc, .profile), SSH authorized_keys backdoors, and init script manipulation. This skill scans for all known persistence vectors, checks file timestamps and integrity, and correlates findings with auditd logs to build a timeline of persistence installation.
攻击者会通过crontab任务、systemd服务/定时器单元、LD_PRELOAD库注入、Shell配置文件修改（.bashrc、.profile）、SSH authorized_keys后门以及初始化脚本操纵等方式在Linux系统上建立持久化访问。本技能会扫描所有已知的持久化向量，检查文件时间戳和完整性，并将检测结果与auditd日志关联，构建持久化机制的安装时间线。

When to Use

使用场景

  • When investigating security incidents that require analyzing persistence mechanisms in linux
  • When building detection rules or threat hunting queries for this domain
  • When SOC analysts need structured procedures for this analysis type
  • When validating security monitoring coverage for related attack techniques
  • 当需要分析Linux系统中的持久化机制以调查安全事件时
  • 当为此领域构建检测规则或威胁狩猎查询时
  • 当SOC分析师需要此类分析的结构化流程时
  • 当验证相关攻击技术的安全监控覆盖范围时

Prerequisites

前置条件

  • Root or sudo access on target Linux system (or forensic image)
  • auditd configured with file watch rules on persistence paths
  • Python 3.8+ with standard library (os, subprocess, json)
  • Optional: OSSEC/Wazuh agent for file integrity monitoring alerts
  • 目标Linux系统（或取证镜像）的Root或sudo权限
  • 已配置针对持久化路径的文件监控规则的auditd
  • Python 3.8+及标准库（os、subprocess、json）
  • 可选：用于文件完整性监控告警的OSSEC/Wazuh agent

Steps

步骤

  1. Scan Crontab Entries — Enumerate all user crontabs, /etc/cron.d/, /etc/cron.daily/, and anacron jobs for suspicious commands
  2. Audit Systemd Units — Check /etc/systemd/system/ and ~/.config/systemd/user/ for non-package-managed service and timer units
  3. Detect LD_PRELOAD Hijacking — Check /etc/ld.so.preload and LD_PRELOAD environment variable for injected shared libraries
  4. Inspect Shell Profiles — Scan .bashrc, .bash_profile, .profile, /etc/profile.d/ for injected commands or reverse shells
  5. Check SSH Authorized Keys — Audit all authorized_keys files for unauthorized public keys with command restrictions
  6. Correlate Auditd Logs — Search auditd logs for file modification events on persistence paths to build an installation timeline
  7. Generate Persistence Report — Produce a risk-scored report of all discovered persistence mechanisms
  1. 扫描Crontab条目 — 枚举所有用户crontab、/etc/cron.d/、/etc/cron.daily/以及anacron任务，查找可疑命令
  2. 审计Systemd单元 — 检查/etc/systemd/system/和~/.config/systemd/user/中未由包管理器管理的服务和定时器单元
  3. 检测LD_PRELOAD劫持 — 检查/etc/ld.so.preload和LD_PRELOAD环境变量，查找注入的共享库
  4. 检查Shell配置文件 — 扫描.bashrc、.bash_profile、.profile、/etc/profile.d/，查找注入的命令或反向Shell
  5. 检查SSH授权密钥 — 审计所有authorized_keys文件，查找带有命令限制的未授权公钥
  6. 关联auditd日志 — 搜索auditd日志中持久化路径的文件修改事件，构建安装时间线
  7. 生成持久化报告 — 生成包含所有已发现持久化机制的风险评分报告

Expected Output

预期输出

  • JSON report of all persistence mechanisms found with risk scores
  • Timeline of persistence installation from auditd correlation
  • MITRE ATT&CK technique mapping (T1053, T1543, T1574, T1546)
  • Remediation commands for each detected persistence mechanism
  • 包含所有已发现持久化机制及风险评分的JSON报告
  • 由auditd关联得到的持久化安装时间线
  • MITRE ATT&CK技术映射（T1053、T1543、T1574、T1546）
  • 针对每个检测到的持久化机制的修复命令