CronGhost v4.0.0

CronGhost v4.0.0 — Initial Release

The first public release of CronGhost — Scheduled Task Shadow Scanner.

What CronGhost does

Scans all 14 Linux persistence locations for malicious attacker
implants, hidden autorun scripts, and scheduled tasks.

Features

• Scans all 14 persistence locations simultaneously
• Tier 1 — pattern detection with high confidence scoring
• Tier 2 — package manager, age, owner verification
• Tier 3 — SHA256 cryptographic baseline comparison
• Entropy analysis — detects encrypted payloads
• Network C2 callback detection — extracts attacker IPs
• Rootkit evasion check — raw readdir vs ls comparison
• Hidden file detector — dotfile scanner
• Self integrity verification — detects tool tampering
• Auto quarantine — preserves forensic evidence
• Live watch mode — real time 30 second monitoring
• Threat history log — persistent audit trail

Install

git clone https://github.com/Artist-22/cronghost.git
cd cronghost
sudo bash install.sh
sudo cronghost

Tested on

• Kali Linux 2025.4

Should work on

• Ubuntu 24.04 (not yet tested)
• Debian 12 (not yet tested)