artif: collect persistence via package managers

artifacts/files/packages/apt.yaml

@@ -0,0 +1,9 @@
+version: 1.0
+# APT can be used to run persistence.
+# ref: https://www.elastic.co/security-labs/sequel-on-persistence-mechanisms
+artifacts:
+  -
+    description: Collect script files under /etc/apt/apt.conf.d/ directory.
+    supported_os: [linux]
+    collector: file
+    path: /etc/apt/apt.conf.d

artifacts/files/packages/dnf.yaml

@@ -0,0 +1,16 @@
+version: 1.0
+# DNF can be used to run persistence.
+# ref: https://www.elastic.co/security-labs/sequel-on-persistence-mechanisms
+artifacts:
+  -
+    description: Collect configuration files under /etc/dnf/pluginconf.d/ directory.
+    supported_os: [linux]
+    collector: file
+    path: /etc/dnf/pluginconf.d
+  -
+    description: Collect script files under dnf-plugins directories.
+    supported_os: [linux]
+    collector: file
+    path: /
+    name_pattern: ["dnf-plugins"]
+    file_type: [d]

artifacts/files/packages/yum.yaml

@@ -0,0 +1,14 @@
+version: 1.0
+# YUM can be used to run persistence.
+# ref: https://www.elastic.co/security-labs/sequel-on-persistence-mechanisms
+artifacts:
+  -
+    description: Collect configuration files under /etc/yum/pluginconf.d/ directory.
+    supported_os: [linux]
+    collector: file
+    path: /etc/yum/pluginconf.d
+  -
+    description: Collect script files under /usr/lib/yum-plugins/ directory.
+    supported_os: [linux]
+    collector: file
+    path: /usr/lib/yum-plugins