Threat Remediation

Generated by rescue threat-remediation. Do not edit by hand.

For each threat the security curriculum describes, here is what to run in Multiverse Device Rescue to check and remediate your own device.

AI worm / malicious package supply-chain compromise

Self-propagating worms (Shai-Hulud, Miasma) spread via npm/git/SSH and AI-agent tooling, planting persistence and command-and-control.

Run: rescue --profile ai_worm_response

Covers: security.ai_worm_persistence.*, security.ai_worm_filesystem.*, security.ai_worm_git_ssh.*, security.ai_worm_lateral.*

Learn more: Criminal Tooling & AI-Written Malware

Mobile spyware on a phone backup (Pegasus-class)

Commercial and nation-state spyware (Pegasus, Predator) hides in device backups; MVT (Mobile Verification Toolkit) scans backups for known indicators of compromise.

Run: rescue --profile ai_worm_response

Covers: security.mvt_spyware_scan.*

Learn more: Mobile Spyware & Surveillanceware

SSH key / credential compromise

Weak, overly permissive, or stolen SSH keys let an attacker impersonate a user, push malicious commits, or pivot to other systems.

Run: rescue run ssh_key_audit

Covers: security.ssh_key_audit.*

Learn more: Credential Theft & SSH Key Hygiene

Unwanted remote access (SSH / Screen Sharing / RDP)

Remote-login services left enabled — macOS Remote Login/Screen Sharing or Windows RDP without Network Level Authentication — give attackers a direct path onto the device.

Run: rescue run remote_login_check win_rdp_check

Covers: security.remote_login_check.*, security.win_rdp_check.*

Learn more: Unwanted Remote Access Services

Malicious launch-time persistence (LaunchAgents/LaunchDaemons)

Malware and worms re-establish themselves after reboot via LaunchAgents/LaunchDaemons — known-malware labels, suspicious paths, or an unusually large number of agents.

Run: rescue run launchd_persistence_audit launch_agent_audit

Covers: security.launchd_persistence_audit.*, security.launch_agent_audit.*

Learn more: Persistence Mechanisms

Command-and-control network beaconing

Compromised hosts phone home to attacker infrastructure — known malicious connections, beaconing patterns, or token-harvesting subprocesses.

Run: rescue --profile ai_worm_response

Covers: security.ai_worm_network.*

Learn more: Network Command-and-Control

Weak or disabled firewall exposure

A disabled firewall or one running without stealth mode leaves the device open to unsolicited inbound connections and network scanning.

Run: rescue run firewall_audit

Covers: security.firewall_audit.*

Learn more: Firewall & Network Exposure

General device compromise (unknown or mixed indicators)

When the specific threat isn't yet known, run a full scan across every module to surface persistence, network, credential, and configuration indicators together.

Run: rescue (full interactive scan)

Covers: security.ai_worm_persistence.*, security.ai_worm_filesystem.*, security.ai_worm_git_ssh.*, security.ai_worm_network.*, security.ai_worm_lateral.*, security.mvt_spyware_scan.*, security.ssh_key_audit.*, security.firewall_audit.*, security.remote_login_check.*, security.win_rdp_check.*, security.launchd_persistence_audit.*, security.launch_agent_audit.*

Learn more: General Device Compromise Triage