Linux/Unix forensic artifacts — log files, configuration, persistence locations, and filesystem indicators — mapped to MITRE ATT&CK techniques and real SigmaHQ detection rules (auditd, builtin syslog, process_creation, file_event, network_connection). Companion to the Windows Registry Explorer.