Skill UI

This guide details the comprehensive process of using the Linux Audit framework (auditd) to detect advanced security threats. It covers deploying specific rules to monitor critical system files, detecting unauthorized privilege escalation, process injection, and suspicious system calls. Users can then leverage ausearch and aureport to efficiently query, reconstruct timelines, and summarize findings for forensic analysis and compliance auditing.

A comprehensive skill for cybersecurity threat hunting and incident response. This tool systematically scans Linux systems to detect various persistence vectors used by adversaries, including suspicious crontab entries, unauthorized systemd units, LD_PRELOAD hijacking, profile modifications (.bashrc), and SSH key backdoors. It correlates findings with auditd logs to build a detailed timeline of compromise.

This skill automates the hardening of Linux endpoints (Ubuntu, RHEL, CentOS) by implementing industry-standard security best practices guided by CIS Benchmarks. It systematically secures various layers, including filesystem permissions, network parameters (sysctl), SSH configuration, user access controls (PAM), and integrates deep auditing using auditd and OpenSCAP. It is essential for achieving compliance with standards like PCI DSS, HIPAA, and SOC 2.