PANIX
A modular Linux persistence framework for security research, detection engineering, and penetration testing.
What is PANIX?
PANIX is a customizable Linux persistence tool designed for security research and detection engineering. It provides a modular framework to simulate and implement various persistence techniques on Linux systems, helping security professionals understand, detect, and defend against adversary behaviors. The tool maps each technique to the MITRE ATT&CK framework for clear threat intelligence alignment.
Security researchers, detection engineers, penetration testers, CTF enthusiasts, and red teamers who need to test or understand Linux persistence mechanisms in controlled environments.
Developers choose PANIX for its comprehensive, modular approach to Linux persistence, paired setup/revert functionality, and direct MITRE ATT&CK mapping, making it uniquely suited for detection engineering and security research over generic exploitation tools.
Overview
Customizable Linux Persistence Tool for Security Research and Detection Engineering.
Use Cases
Best For
- Simulating adversary persistence techniques for detection engineering
- Testing and validating security monitoring rules on Linux systems
- Red team exercises requiring diverse Linux backdoor methods
- Learning Linux persistence mechanisms for security research
- CTF challenges involving post-exploitation persistence
- Developing defensive strategies against MITRE ATT&CK techniques
Not Ideal For
- Cross-platform security testing involving Windows or macOS systems
- Operational environments where minimal detection and stealth are paramount
- Automated penetration testing workflows requiring headless or script-only execution
- Educational labs or environments without root privileges
Pros & Cons
Pros
Implements over 40 persistence methods including cron jobs, systemd services, and kernel modules, as detailed in the comprehensive features table.
Every persistence module has a corresponding revert script, ensuring easy removal and testing, demonstrated in the revert mechanism examples.
Includes a built-in matrix mapping each technique to MITRE ATT&CK IDs, aiding detection engineering and threat intelligence alignment.
Tested on Debian, Ubuntu, RHEL, CentOS, and others, with mechanisms adapted for different Linux flavors, though some limitations exist.
Offers default and custom modes with detailed help menus and examples for each mechanism, facilitating tailored use in various scenarios.
Cons
Many modules, such as backdoor user creation and kernel modules, require root access, limiting use in restricted or user-level testing environments.
Some techniques are unavailable on certain distributions, like Diamorphine rootkit on Ubuntu or MOTD persistence on RHEL derivatives, as noted in the support table.
Using well-documented persistence methods may be easily flagged by security tools, reducing stealth in real-world adversarial simulations.
Custom or outdated Linux distributions may have configuration issues, requiring manual adjustments with the --custom flag, which can be error-prone.
Frequently Asked Questions
Related Projects
DiamorphineLKM rootkit for Linux Kernels 2.6.x/3.x/4.x/5.x/6.x (x86/x86_64 and ARM64)
TripleCrossA Linux eBPF rootkit with a backdoor, C2, library injection, execution hijacking, persistence and stealth capabilities.
ebpfkitebpfkit is a rootkit powered by eBPF
Linux Security and Monitoring ScriptsLinux Security and Monitoring Scripts
Found a gem we're missing?
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.