Identify Linux security incidents by querying host telemetry with Velociraptor VQL.
npx skills add https://github.com/chenchunrun/onyx-soc --skill linux-ir
Please help me install this Agent Skill. Skill: linux-ir Source: https://github.com/chenchunrun/onyx-soc/tree/main/skills/linux-ir Command: npx skills add https://github.com/chenchunrun/onyx-soc --skill linux-ir
This Skill helps security teams quickly identify and investigate Linux-based intrusions by providing ready-to-run threat-hunting workflows using Velociraptor to surface suspicious processes, network connections, persistence mechanisms, and memory-based indicators.
Run the Linux IR quick scan to generate an overview of the host security posture.
High-intent search queries and answers about installing and using this skill.
This Skill hunts for Linux persistence mechanisms using Velociraptor by running ATT&CK-aligned VQL queries targeting techniques like T1543 and T1547 to surface suspicious startup scripts and kernel modules directly from host telemetry.
The best way to investigate suspicious network activity on a compromised Linux host is to use this Skill's Velociraptor VQL queries, which collect and query host telemetry to surface malicious network indicators during incident response.
Yes, you need Velociraptor deployed to detect fileless malware on Linux because this Skill relies entirely on Velociraptor-based workflows and VQL queries to surface memory-based indicators and fileless intrusions.
Yes, you can use VQL queries to detect privilege abuse on Linux systems. This Skill provides ready-to-run detection modules that query process telemetry to identify unauthorized privilege escalation and abuse.
To start a quick scan for indicators of compromise on a Linux endpoint, run the Linux IR quick scan provided by this Skill to generate an overview of the host security posture and surface suspicious processes.
AgentSecOpsAnalyze endpoint telemetry and artifacts for incident response with Velociraptor VQL workflows.
YukiIto1999Analyze Windows RAM memory dumps with Volatility 3 to detect malware artifacts and indicators of compromise.
vignesh2027Model threats and develop hunting hypotheses aligned to MITRE ATT&CK techniques.
zebbernEnumerate Windows privileges and misconfigurations to identify privilege escalation vectors.
