Which Linux distributions does this skill support?

The skill supports Debian/Ubuntu, RHEL/CentOS/Rocky, and SUSE (openSUSE/SLES) families, automatically adapting its commands to the detected distribution.

How does it identify unauthorized persistence?

It audits crontabs, systemd timers, init scripts, and PAM modules, and flags systemd units that were added outside of the standard package manager.

Is the forensic report compliant with industry standards?

Yes, the generated findings document follows the collection ordering and structure defined in NIST SP 800-86 for forensic techniques in incident response.

Does this skill require root or sudo privileges?

Yes, for a complete forensic analysis—including reading authentication logs and verifying system-wide package integrity—elevated privileges are required.

Can I use this for remote server investigations?

Absolutely. It can be triggered locally or against remote targets where Claude has shell access, making it ideal for triaging cloud instances or remote servers.

Linux Incident Response & Forensics

Name: Linux Incident Response & Forensics
Author: jmagly

byjmagly

•

102

•

Security & Testing

Automates structured forensic analysis and incident response across major Linux distribution families including Debian, RHEL, and SUSE.

This skill provides a standardized framework for performing digital forensics and incident response (DFIR) on Linux systems. It automatically detects the host distribution to select the correct package integrity tools and log paths, ensuring accurate evidence collection across diverse environments. By auditing authentication logs, persistence mechanisms, modified files, and network states, it generates a comprehensive findings report aligned with NIST SP 800-86 standards. It is an essential tool for security professionals and system administrators needing to investigate compromises or verify system integrity with high confidence.

Key Features

01Comprehensive audit of persistence mechanisms including systemd, cron, and PAM

02102 GitHub stars

03Real-time analysis of network connections and suspicious process states

04Standardized NIST-aligned reporting with severity-tagged findings

05Automated package integrity verification via debsums and rpm databases

06Automatic distribution detection for Debian, RHEL, and SUSE families

Use Cases

01Auditing authentication logs and scheduled tasks for persistence during routine security reviews

02Rapid triage and forensic evidence collection on a suspected compromised host

03Verifying system binary integrity after a security alert or unauthorized access

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add jmagly/aiwg linux-forensics

For use in Claude.ai and ChatGPT