A modular Linux persistence framework for security research, detection engineering, and penetration testing.
PANIX is a customizable Linux persistence tool designed for security research and detection engineering. It provides a modular framework to simulate and implement various persistence techniques on Linux systems, helping security professionals understand, detect, and defend against adversary behaviors. The tool maps each technique to the MITRE ATT&CK framework for clear threat intelligence alignment.
Security researchers, detection engineers, penetration testers, CTF enthusiasts, and red teamers who need to test or understand Linux persistence mechanisms in controlled environments.
Developers choose PANIX for its comprehensive, modular approach to Linux persistence, paired setup/revert functionality, and direct MITRE ATT&CK mapping, making it uniquely suited for detection engineering and security research over generic exploitation tools.
Customizable Linux Persistence Tool for Security Research and Detection Engineering.
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Implements over 40 persistence methods including cron jobs, systemd services, and kernel modules, as detailed in the comprehensive features table.
Every persistence module has a corresponding revert script, ensuring easy removal and testing, demonstrated in the revert mechanism examples.
Includes a built-in matrix mapping each technique to MITRE ATT&CK IDs, aiding detection engineering and threat intelligence alignment.
Tested on Debian, Ubuntu, RHEL, CentOS, and others, with mechanisms adapted for different Linux flavors, though some limitations exist.
Offers default and custom modes with detailed help menus and examples for each mechanism, facilitating tailored use in various scenarios.
Many modules, such as backdoor user creation and kernel modules, require root access, limiting use in restricted or user-level testing environments.
Some techniques are unavailable on certain distributions, like Diamorphine rootkit on Ubuntu or MOTD persistence on RHEL derivatives, as noted in the support table.
Using well-documented persistence methods may be easily flagged by security tools, reducing stealth in real-world adversarial simulations.
Custom or outdated Linux distributions may have configuration issues, requiring manual adjustments with the --custom flag, which can be error-prone.