Development of a forensic software tool for detecting persistence mechanisms in Linux operating system

Cyber attacks are becoming more and more destructive and threatening information technology systems. These threats, in general, use various methods to maintain their current access after the attackers infiltrate the systems. One of the most important of these methods is persistence mechanisms. Attackers aim to maintain their access by ensuring persistence on infected systems. Forensic analysis is required to detect the spread of attackers on infected systems. Detectability of persistence mechanisms on Linux systems; The open source and customizable nature of the Linux operating system makes it difficult to detect. For this reason, an attack scenario was created and implemented in a laboratory environment to understand the possible persistence mechanisms that can be realized on Linux systems. A tool was developed using python language to detect the activities performed on persistent systems. With this tool, it is aimed to enable cyber security analysts to perform fast, effective, target-oriented analysis on Linux systems and to facilitate the analysis processes. Target-oriented analysis of the persistence mechanisms realized in the persistence mechanism scenario application was provided with the newly developed tool and it was evaluated that the tool facilitated the analysis processes.