ai-chatbot/docs/security/perf-guard.md

Perf Guard

This repository includes a server guard for persistent miner-style malware IOC patterns.

Install on server

Run from repo root as root:

bash scripts/security/install-perf-guard.sh

Or install full security baseline (recommended):

bash scripts/security/install-security-stack.sh

What it does

• Runs every 15 seconds via systemd timer.
• Kills suspicious processes by known IOC patterns.
• Removes known IOC files and directories.
• Cleans suspicious root cron and startup hooks.
• Locks suspicious user sysupdate if present.
• Writes logs to /var/log/perf-guard.log.

Check status

systemctl status perf-guard.timer --no-pager
systemctl status perf-guard.service --no-pager

tail -n 100 /var/log/perf-guard.log