Форензика Linux — анализ следов компрометации

★ 8.4 · security

analyzing-linux-system-artifacts is a Claude Code skill that examines Linux system artifacts — authentication logs, cron and systemd persistence mechanisms, shell history, SSH keys, and system configuration — to uncover evidence of compromise, detect rootkits or backdoors, and reconstruct user and attacker activity. The workflow covers mounting a forensic image read-only, collecting artifacts from /var/log/, /etc/, and home directories, analyzing user accounts and password hashes, and auditing persistence vectors including cron jobs, systemd units, and SSH authorized_keys. It leverages tools such as chkrootkit, rkhunter, AIDE, and auditd, and maps findings to MITRE ATT&CK techniques T1070, T1059.004, T1543.002, and T1053.003. Built for incident responders and digital forensics analysts investigating compromised Linux servers or workstations.