# Perf Guard

This repository includes a server guard for persistent miner-style malware IOC patterns.

## Install on server

Run from repo root as root:

```bash
bash scripts/security/install-perf-guard.sh
```

Or install full security baseline (recommended):

```bash
bash scripts/security/install-security-stack.sh
```

## What it does

- Runs every 15 seconds via `systemd` timer.
- Kills suspicious processes by known IOC patterns.
- Removes known IOC files and directories.
- Cleans suspicious root cron and startup hooks.
- Locks suspicious user `sysupdate` if present.
- Writes logs to `/var/log/perf-guard.log`.

## Check status

```bash
systemctl status perf-guard.timer --no-pager
systemctl status perf-guard.service --no-pager

tail -n 100 /var/log/perf-guard.log
```