artif: new persistence mechanisms artifacts

CHANGELOG.md

@@ -4,12 +4,14 @@
 
 ### Artifacts
 
-- live_response/system/coredump.yaml: Added collection of core dump files information [linux] ([mnrkbys](https://github.com/mnrkbys)).
-- live_response/system/ulimit.yaml: Added collection of all resource limits information [all] ([mnrkbys](https://github.com/mnrkbys)).
-- memory_dump/coredump.yaml: Added collection of core dump, ABRT, Apport, and kdump files [esxi, linux, netbsd] ([mnrkbys](https://github.com/mnrkbys)).
+- files/system/upstart.yaml: Added collection of system-wide and user-session Upstart configuration files [linux].
+- files/system/xdg_autostart.yaml: Added collection of system-wide and user-specific XDG autostart files [linux].
 - live_response/packages/dpkg.yaml: Updated to verify all packages to compare information about the installed files in the package with information about the files taken from the package metadata stored in the dpkg database [linux] ([mnrkbys](https://github.com/mnrkbys)).
 - live_response/packages/package_owns_file.yaml: Added collection of which installed package owns a specific file or command. Note that this artifact is resource-intensive and time-consuming to execute, so it is disabled by default in all profiles [linux] ([mnrkbys](https://github.com/mnrkbys)).
+- live_response/system/coredump.yaml: Added collection of core dump files information [linux] ([mnrkbys](https://github.com/mnrkbys)).
 - live_response/system/getcap.yaml: Added functionality to collect the list of files with associated process capabilities [linux] ([mnrkbys](https://github.com/mnrkbys)).
+- live_response/system/ulimit.yaml: Added collection of all resource limits information [all] ([mnrkbys](https://github.com/mnrkbys)).
+- memory_dump/coredump.yaml: Added collection of core dump, ABRT, Apport, and kdump files [esxi, linux, netbsd] ([mnrkbys](https://github.com/mnrkbys)).
 
 ### New Artifacts Properties
 

artifacts/files/system/etc.yaml

@@ -23,3 +23,7 @@ artifacts:
     exclude_name_pattern: ["shadow", "shadow-"]
     file_type: [f]
     ignore_date_range: true
+
+# References:
+# https://www.elastic.co/security-labs/primer-on-persistence-mechanisms
+# https://www.elastic.co/security-labs/sequel-on-persistence-mechanisms

artifacts/files/system/upstart.yaml

@@ -0,0 +1,25 @@
+version: 1.0
+artifacts:
+  -
+    description: Collect system-wide Upstart configuration files.
+    supported_os: [linux]
+    collector: file
+    path: /etc/init
+  -
+    description: Collect system-wide Upstart configuration files.
+    supported_os: [linux]
+    collector: file
+    path: /etc/xdg/upstart
+  -
+    description: Collect system-wide Upstart configuration files.
+    supported_os: [linux]
+    collector: file
+    path: /usr/share/upstart/sessions
+  -
+    description: Collect user-session Upstart configuration files.
+    supported_os: [linux]
+    collector: file
+    path: /%user_home%/.config/upstart
+
+# References:
+# https://www.elastic.co/security-labs/sequel-on-persistence-mechanisms

artifacts/files/system/xdg_autostart.yaml

@@ -0,0 +1,30 @@
+version: 1.0
+artifacts:
+  -
+    description: Collect system-wide XDG autostart files.
+    supported_os: [linux]
+    collector: file
+    path: /etc/xdg/autostart
+  -
+    description: Collect system-wide XDG autostart files.
+    supported_os: [linux]
+    collector: file
+    path: /usr/share/autostart
+  -
+    description: Collect user-specific XDG autostart files.
+    supported_os: [linux]
+    collector: file
+    path: /%user_home%/.config/autostart
+  -
+    description: Collect user-specific XDG autostart files.
+    supported_os: [linux]
+    collector: file
+    path: /%user_home%/.local/share/autostart
+  -
+    description: Collect user-specific XDG autostart files (not part of XDG standard, but used by KDE).
+    supported_os: [linux]
+    collector: file
+    path: /%user_home%/.config/autostart-scripts
+
+# References:
+# https://www.elastic.co/security-labs/primer-on-persistence-mechanisms