op-trace

Storage Policy: ALL output files MUST be saved in the project directory. NEVER write to /tmp/ or any system temporary directory.

Trace Scanning and Elimination

Target and options: $ARGUMENTS

1. Parse $ARGUMENTS for target host and mode flag (--scan-only or --eliminate). Default to --scan-only if neither flag is specified.

2. Phase 1 — Scan: Check for forensic artifacts across all categories:

   • Login records: Examine wtmp, btmp, lastlog, /var/log/auth.log for entries matching the operator's activity window. Flag any login entries, failed attempts, or sudo usage.

   • Command history: Search for shell history files:

     • ~/.bash_history
     • ~/.zsh_history
     • ~/.python_history
     • ~/.mysql_history
     • ~/.psql_history Flag any files with recent entries or non-zero size.

   • Temp files: Scan /tmp/*, /dev/shm/*, /var/tmp/* for files created during the operational window. Flag any files owned by the operator or with suspicious names.

   • Cron entries: Check crontab -l for current user and root. Scan /etc/cron.* directories and /var/spool/cron/ for persistence mechanisms.

   • SSH artifacts: Inspect:

     • ~/.ssh/authorized_keys for added keys
     • ~/.ssh/known_hosts for target entries
     • Recent SSH connection logs in auth.log
     • SSH agent socket files

   • Recent files accessed: Check ~/.local/share/recently-used.xbel and similar desktop tracking files for recently opened files.

   • Connection logs: Search for network connection records in logs — ss output snapshots, netstat entries, firewall logs, and /var/log/messages for connection-related entries.

3. Phase 2 — Report: Present all findings categorized by risk level:

   • CRITICAL: Active persistence mechanisms (cron jobs, authorized_keys, running processes)
   • HIGH: Login records, command history with operational commands
   • MEDIUM: Temp files, SSH known_hosts entries, connection logs
   • LOW: Recently-used file trackers, cached data

4. Phase 3 — Eliminate (only if --eliminate flag is set):

   • For each trace found, present the artifact to the user and ask for confirmation before removal via AskUserQuestion
   • Remove artifacts in order from CRITICAL to LOW severity
   • For login records: use utmpdump/utmpset or direct binary editing to remove specific entries
   • For history files: truncate or selectively remove lines
   • For temp files: secure-delete with shred then rm
   • For cron entries: remove specific lines from crontab
   • For SSH artifacts: remove specific lines from authorized_keys and known_hosts
   • Verify each removal was successful

5. Log all findings to the ops tracker:

   node "${CLAUDE_PLUGIN_ROOT}/scripts/ops-tracker.js" add <target> trace-scan <category> "<artifact>" <risk-level> <status>
   

6. Write the trace report to the project directory. Include all scanned categories, findings with risk levels, and elimination status if --eliminate was used.