How do I install the Hunting For Persistence Mechanisms In Windows skill?

Run npx skillmds@latest add gabrielmoreira/hunting-for-persistence-mechanisms-in-windows in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Hunting For Persistence Mechanisms In Windows safe to use?

This skill has not completed SkillMD's automated safety review yet. Independent scanners report: SkillSpector: PASS, Skill Scanner: WARNING. Capability flags: docs only, executes scripts. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Hunting For Persistence Mechanisms In Windows?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Hunting For Persistence Mechanisms In Windows free to use?

Yes. Installing skills from SkillMD is free. This skill is licensed under Apache-2.

Who published Hunting For Persistence Mechanisms In Windows?

gabrielmoreira (@gabrielmoreira) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Hunting For Persistence Mechanisms In Windows by gabrielmoreira

Name: Hunting For Persistence Mechanisms In Windows
Rating: 4.2 (5 reviews)
Author: gabrielmoreira

Hunting For Persistence Mechanisms In Windows

Systematically hunts for adversary persistence mechanisms across Windows endpoints, covering registry Run/RunOnce keys, services, startup folders, scheduled tasks, and WMI event subscriptions. Use when performing a broad persistence sweep during incident response or building SIEM detections that cover the full range of Windows persistence techniques (MITRE T1547).

gabrielmoreira Updated Sep 9, 2026 17 repo stars

File contents

Hunting for Persistence Mechanisms in Windows

When to Use

During periodic proactive threat hunts for dormant backdoors
After an incident to identify all persistence mechanisms an attacker planted
When investigating unusual services, scheduled tasks, or startup entries
When threat intel reports describe new persistence techniques in the wild
During security posture assessments to identify unauthorized persistent software

Prerequisites

Sysmon deployed with Event IDs 12/13/14 (Registry), 19/20/21 (WMI), 1 (Process Creation)
Windows Security Event forwarding for 4697 (Service Install), 4698 (Scheduled Task)
EDR with registry and file monitoring capabilities
PowerShell script block logging enabled (Event ID 4104)
Autoruns or equivalent baseline of legitimate persistent entries

Workflow

Enumerate Known Persistence Locations: Build a comprehensive list of Windows persistence points (Run keys, services, scheduled tasks, WMI, startup folder, DLL search order, COM hijacks, AppInit DLLs, Image File Execution Options).
Collect Endpoint Data: Use EDR, Sysmon, or Velociraptor to collect current persistence artifacts from endpoints across the environment.
Baseline Legitimate Persistence: Compare collected data against known-good baselines (Autoruns snapshots, GPO-deployed entries, SCCM configurations).
Identify Anomalies: Flag new, unsigned, or unknown entries in persistence locations that deviate from the baseline.
Investigate Suspicious Entries: For each anomaly, examine the binary it points to, its digital signature, file hash, and creation timestamp.
Correlate with Process Activity: Link persistence entries to process execution, network activity, and user login events.
Document and Remediate: Record findings, remove malicious persistence, and update detection rules.

Key Concepts

Concept	Description
T1547.001	Registry Run Keys / Startup Folder
T1543.003	Windows Service (Create or Modify)
T1053.005	Scheduled Task
T1546.003	WMI Event Subscription
T1546.015	Component Object Model (COM) Hijacking
T1546.012	Image File Execution Options Injection
T1546.010	AppInit DLLs
T1547.004	Winlogon Helper DLL
T1547.005	Security Support Provider
T1574.001	DLL Search Order Hijacking
TA0003	Persistence Tactic
Autoruns	Sysinternals tool showing persistent entries

Tools & Systems

Tool	Purpose
Sysinternals Autoruns	Comprehensive persistence enumeration
Velociraptor	Endpoint-wide persistence artifact collection
CrowdStrike Falcon	Real-time persistence monitoring
Sysmon	Registry and WMI event monitoring
OSQuery	SQL-based persistence queries
RECmd	Registry Explorer for forensic analysis
Splunk	SIEM correlation of persistence events

Common Scenarios

Registry Run Key Backdoor: Malware adds HKCU\Software\Microsoft\Windows\CurrentVersion\Run entry pointing to payload in %APPDATA%.
WMI Event Subscription: Adversary creates WMI consumer/filter pair that executes PowerShell on system boot.
Malicious Service: Attacker creates Windows service with sc create pointing to a backdoor binary.
COM Object Hijack: Legitimate COM CLSID InprocServer32 path replaced with malicious DLL.
IFEO Debugger Injection: Image File Execution Options key set with debugger pointing to implant for common utilities.

Output Format

Hunt ID: TH-PERSIST-[DATE]-[SEQ]
Persistence Type: [Registry/Service/Task/WMI/COM/Other]
MITRE Technique: T1547.xxx / T1543.xxx / T1053.xxx
Location: [Full registry key / service name / task path]
Value: [Binary path / command line]
Host(s): [Affected endpoints]
Signed: [Yes/No]
Hash: [SHA256]
Creation Time: [Timestamp]
Risk Level: [Critical/High/Medium/Low]
Verdict: [Malicious/Suspicious/Benign]

---name: hunting-for-persistence-mechanisms-in-windowsdescription: Systematically hunts for adversary persistence mechanisms across Windows endpoints, covering registry Run/RunOnce keys, services, startup folders, scheduled tasks, and WMI event subscriptions. Use when performing a broad persistence sweep during incident response or building SIEM detections that cover the full range of Windows persistence techniques (MITRE T1547).license: Apache-2.0--- # Hunting for Persistence Mechanisms in Windows ## When to Use - During periodic proactive threat hunts for dormant backdoors - After an incident to identify all persistence mechanisms an attacker planted - When investigating unusual services, scheduled tasks, or startup entries - When threat intel reports describe new persistence techniques in the wild - During security posture assessments to identify unauthorized persistent software ## Prerequisites - Sysmon deployed with Event IDs 12/13/14 (Registry), 19/20/21 (WMI), 1 (Process Creation) - Windows Security Event forwarding for 4697 (Service Install), 4698 (Scheduled Task) - EDR with registry and file monitoring capabilities - PowerShell script block logging enabled (Event ID 4104) - Autoruns or equivalent baseline of legitimate persistent entries ## Workflow 1. **Enumerate Known Persistence Locations**: Build a comprehensive list of Windows persistence points (Run keys, services, scheduled tasks, WMI, startup folder, DLL search order, COM hijacks, AppInit DLLs, Image File Execution Options). 2. **Collect Endpoint Data**: Use EDR, Sysmon, or Velociraptor to collect current persistence artifacts from endpoints across the environment. 3. **Baseline Legitimate Persistence**: Compare collected data against known-good baselines (Autoruns snapshots, GPO-deployed entries, SCCM configurations). 4. **Identify Anomalies**: Flag new, unsigned, or unknown entries in persistence locations that deviate from the baseline. 5. **Investigate Suspicious Entries**: For each anomaly, examine the binary it points to, its digital signature, file hash, and creation timestamp. 6. **Correlate with Process Activity**: Link persistence entries to process execution, network activity, and user login events. 7. **Document and Remediate**: Record findings, remove malicious persistence, and update detection rules. ## Key Concepts | Concept | Description | |---------|-------------| | T1547.001 | Registry Run Keys / Startup Folder | | T1543.003 | Windows Service (Create or Modify) | | T1053.005 | Scheduled Task | | T1546.003 | WMI Event Subscription | | T1546.015 | Component Object Model (COM) Hijacking | | T1546.012 | Image File Execution Options Injection | | T1546.010 | AppInit DLLs | | T1547.004 | Winlogon Helper DLL | | T1547.005 | Security Support Provider | | T1574.001 | DLL Search Order Hijacking | | TA0003 | Persistence Tactic | | Autoruns | Sysinternals tool showing persistent entries | ## Tools & Systems | Tool | Purpose | |------|---------| | Sysinternals Autoruns | Comprehensive persistence enumeration | | Velociraptor | Endpoint-wide persistence artifact collection | | CrowdStrike Falcon | Real-time persistence monitoring | | Sysmon | Registry and WMI event monitoring | | OSQuery | SQL-based persistence queries | | RECmd | Registry Explorer for forensic analysis | | Splunk | SIEM correlation of persistence events | ## Common Scenarios 1. **Registry Run Key Backdoor**: Malware adds `HKCU\Software\Microsoft\Windows\CurrentVersion\Run` entry pointing to payload in `%APPDATA%`. 2. **WMI Event Subscription**: Adversary creates WMI consumer/filter pair that executes PowerShell on system boot. 3. **Malicious Service**: Attacker creates Windows service with `sc create` pointing to a backdoor binary. 4. **COM Object Hijack**: Legitimate COM CLSID InprocServer32 path replaced with malicious DLL. 5. **IFEO Debugger Injection**: Image File Execution Options key set with debugger pointing to implant for common utilities. ## Output Format ``` Hunt ID: TH-PERSIST-[DATE]-[SEQ] Persistence Type: [Registry/Service/Task/WMI/COM/Other] MITRE Technique: T1547.xxx / T1543.xxx / T1053.xxx Location: [Full registry key / service name / task path] Value: [Binary path / command line] Host(s): [Affected endpoints] Signed: [Yes/No] Hash: [SHA256] Creation Time: [Timestamp] Risk Level: [Critical/High/Medium/Low] Verdict: [Malicious/Suspicious/Benign] ```

Frequently asked questions