36 lines
780 B
Markdown
36 lines
780 B
Markdown
# Perf Guard
|
|
|
|
This repository includes a server guard for persistent miner-style malware IOC patterns.
|
|
|
|
## Install on server
|
|
|
|
Run from repo root as root:
|
|
|
|
```bash
|
|
bash scripts/security/install-perf-guard.sh
|
|
```
|
|
|
|
Or install full security baseline (recommended):
|
|
|
|
```bash
|
|
bash scripts/security/install-security-stack.sh
|
|
```
|
|
|
|
## What it does
|
|
|
|
- Runs every 15 seconds via `systemd` timer.
|
|
- Kills suspicious processes by known IOC patterns.
|
|
- Removes known IOC files and directories.
|
|
- Cleans suspicious root cron and startup hooks.
|
|
- Locks suspicious user `sysupdate` if present.
|
|
- Writes logs to `/var/log/perf-guard.log`.
|
|
|
|
## Check status
|
|
|
|
```bash
|
|
systemctl status perf-guard.timer --no-pager
|
|
systemctl status perf-guard.service --no-pager
|
|
|
|
tail -n 100 /var/log/perf-guard.log
|
|
```
|