linux-ir

What problem does it solve?

This Skill helps security teams quickly identify and investigate Linux-based intrusions by providing ready-to-run threat-hunting workflows using Velociraptor to surface suspicious processes, network connections, persistence mechanisms, and memory-based indicators.

Core Features & Use Cases

• Velociraptor-based threat hunting across Linux hosts (process, network, persistence, fileless indicators).
• Provides ATT&CK-aligned detections (T1059, T1070, T1543, T1547, T1014) in ready-to-run queries.
• Use Case: An IR team runs quick scans to surface indicators of compromise on a compromised Linux host and then pivots to targeted investigations.

Quick Start

Run the Linux IR quick scan to generate an overview of the host security posture.