Hunting For Registry Persistence
FreeProactively detect Windows registry persistence mechanisms.
Free · Opens the source repo
What Hunting For Registry Persistence does
Hunting For Registry Persistence is a specialized skill designed for cybersecurity professionals focused on identifying registry-based persistence mechanisms in Windows environments. This skill leverages the MITRE ATT&CK framework, specifically technique T1547, to aid in the detection of various methods adversaries use to maintain persistence on compromised systems. By examining registry entries such as Run/RunOnce keys, Winlogon modifications, and COM hijacking, users can uncover potential indicators of compromise (IoCs) associated with malicious activities.
The skill is particularly useful during proactive threat hunting, incident response, and security assessments. It guides users through a structured workflow, starting from formulating a hypothesis based on threat intelligence to documenting findings and updating detection rules. This systematic approach ensures that security teams can effectively correlate activity across different data sources, enhancing their ability to identify and respond to threats in real-time.
To utilize this skill, users should have a robust security infrastructure in place, including an EDR platform with telemetry capabilities and a SIEM for log analysis. The skill also emphasizes the importance of threat intelligence feeds for correlating indicators and validating findings. By integrating these components, security teams can improve their detection capabilities and respond swiftly to potential threats.
Overall, Hunting For Registry Persistence is an essential tool for security analysts and incident responders who need to stay ahead of sophisticated threat actors leveraging registry-based techniques to maintain footholds within Windows environments.
When to use it
Use this skill when proactively hunting for registry persistence indicators or during incident response to scope compromises related to these techniques.
When not to use it
This skill may not be suitable for environments lacking the necessary telemetry or security infrastructure, such as EDR or SIEM systems.
What you can build with it
Malware Persistence Detection
Identify when malware adds a Run key in HKCU to maintain user-level persistence.
Winlogon Modification
Detect adversaries modifying Winlogon Shell for system-level persistence.
Debugger Injection Analysis
Investigate IFEO debugger injection techniques used for backdoor access.
How to install Hunting For Registry Persistence
View source1. Install with the skills CLI
npx skills add mukul975/anthropic-cybersecurity-skills/hunting-for-registry-persistence-mechanisms --agent claude-code2. Or install it manually
Download the skill folder and drop it into ~/.claude/skills/ for all projects, or .claude/skills/ to scope it to one repo. Restart Claude Code so it picks up the new skill.
Anthropic's agentic coding CLI, and the reference implementation of Agent Skills. Drop a skill folder into ~/.claude/skills and Claude Code loads it automatically whenever a task matches the skill's description. Claude Code docs
Inside SKILL.md
Written by mukul975Hunting For Registry Persistence Mechanisms
When to Use
- When proactively hunting for indicators of hunting for registry persistence mechanisms in the environment
- After threat intelligence indicates active campaigns using these techniques
- During incident response to scope compromise related to these techniques
- When EDR or SIEM alerts trigger on related indicators
- During periodic security assessments and purple team exercises
Prerequisites
- EDR platform with process and network telemetry (CrowdStrike, MDE, SentinelOne)
- SIEM with relevant log data ingested (Splunk, Elastic, Sentinel)
- Sysmon deployed with comprehensive configuration
- Windows Security Event Log forwarding enabled
- Threat intelligence feeds for IOC correlation
Workflow
- Formulate Hypothesis: Define a testable hypothesis based on threat intelligence or ATT&CK gap analysis.
- Identify Data Sources: Determine which logs and telemetry are needed to validate or refute the hypothesis.
- Execute Queries: Run detection queries against SIEM and EDR platforms to collect relevant events.
- Analyze Results: Examine query results for anomalies, correlating across multiple data sources.
- Validate Findings: Distinguish true positives from false positives through contextual analysis.
- Correlate Activity: Link findings to broader attack chains and threat actor TTPs.
- Document and Report: Record findings, update detection rules, and recommend response actions.
Key Concepts
| Concept | Description |
|---|---|
| T1547.001 | Registry Run Keys |
| T1547.004 | Winlogon Helper DLL |
| T1546.012 | IFEO Injection |
| T1546.015 | COM Hijacking |
Tools & Systems
| Tool | Purpose |
|---|---|
| CrowdStrike Falcon | EDR telemetry and threat detection |
| Microsoft Defender for Endpoint | Advanced hunting with KQL |
| Splunk Enterprise | SIEM log analysis with SPL queries |
| Elastic Security | Detection rules and investigation timeline |
| Sysmon | Detailed Windows event monitoring |
| Velociraptor | Endpoint artifact collection and hunting |
| Sigma Rules | Cross-platform detection rule format |
Common Scenarios
- Scenario 1: Malware adding HKCU Run key for user-level persistence
- Scenario 2: Adversary modifying Winlogon Shell for system-level persistence
- Scenario 3: IFEO debugger injection for accessibility feature backdoor
- Scenario 4: COM object InprocServer32 hijack for DLL loading
Output Format
Hunt ID: TH-HUNTIN-[DATE]-[SEQ]
Technique: T1547.001
Host: [Hostname]
User: [Account context]
Evidence: [Log entries, process trees, network data]
Risk Level: [Critical/High/Medium/Low]
Confidence: [High/Medium/Low]
Recommended Action: [Containment, investigation, monitoring]
Frequently asked questions about Hunting For Registry Persistence
Similar skills
Asset Criticality Scoring for Vulns
Prioritize vulnerabilities based on asset criticality.
Performing Alert Triage with Elastic SIEM
Streamline alert triage processes in Elastic Security.
Active Directory Vulnerability Assessment
Secure your Active Directory with comprehensive assessments.
Active Directory Investigation
Streamline your Active Directory compromise investigations.
Parsing Artifacts with Eric Zimmerman Tools
Efficiently parse Windows forensic artifacts for analysis.
Operationalizing MISP Threat Feeds
Enhance threat detection with curated MISP feeds.