Hunting for Windows Persistence
FreeIdentify and analyze persistence mechanisms on Windows systems.
Free · Opens the source repo
What Hunting for Windows Persistence does
The 'Hunting for Persistence Mechanisms in Windows' skill is designed for cybersecurity professionals engaged in threat hunting and incident response. It systematically identifies adversary persistence mechanisms across Windows endpoints, focusing on various persistence techniques such as registry Run/RunOnce keys, services, startup folders, scheduled tasks, and WMI event subscriptions. This skill is particularly useful during proactive threat hunts, post-incident investigations, or when assessing security postures to uncover unauthorized persistent software.
To utilize this skill effectively, practitioners should have Sysmon and EDR tools configured to collect relevant event data. The skill provides a structured workflow that begins with enumerating known persistence locations and collecting data from endpoints. It then compares this data against established baselines to identify anomalies, which may indicate malicious activity. The skill also emphasizes the importance of correlating persistence entries with process activity and documenting findings for remediation purposes.
This skill is particularly suited for security analysts, incident responders, and threat hunters who require a comprehensive approach to identifying and mitigating potential threats on Windows systems. By leveraging the MITRE ATT&CK framework, specifically technique T1547 related to persistence, users can enhance their detection capabilities and improve their overall security posture.
Incorporating this skill into a security operations workflow allows teams to proactively hunt for dormant threats, investigate suspicious entries, and respond effectively to incidents involving persistence mechanisms. It is a valuable addition for those looking to strengthen their defenses against advanced adversaries targeting Windows environments.
When to use it
Use this skill during proactive threat hunts, post-incident investigations, or security posture assessments to uncover unauthorized persistence mechanisms.
When not to use it
This skill may not be suitable for environments without the necessary logging and monitoring tools in place, such as Sysmon or EDR systems.
What you can build with it
Post-Incident Investigation
After a security incident, use this skill to identify all persistence mechanisms an attacker may have left behind.
Proactive Threat Hunting
During regular threat hunting exercises, utilize this skill to search for dormant backdoors or unauthorized software.
Security Posture Assessment
Employ this skill to assess your security posture by identifying unauthorized persistent software across your Windows environment.
How to install Hunting for Windows Persistence
View source1. Install with the skills CLI
npx skills add mukul975/anthropic-cybersecurity-skills/hunting-for-persistence-mechanisms-in-windows --agent claude-code2. Or install it manually
Download the skill folder and drop it into ~/.claude/skills/ for all projects, or .claude/skills/ to scope it to one repo. Restart Claude Code so it picks up the new skill.
Anthropic's agentic coding CLI, and the reference implementation of Agent Skills. Drop a skill folder into ~/.claude/skills and Claude Code loads it automatically whenever a task matches the skill's description. Claude Code docs
Inside SKILL.md
Written by mukul975Hunting for Persistence Mechanisms in Windows
When to Use
- During periodic proactive threat hunts for dormant backdoors
- After an incident to identify all persistence mechanisms an attacker planted
- When investigating unusual services, scheduled tasks, or startup entries
- When threat intel reports describe new persistence techniques in the wild
- During security posture assessments to identify unauthorized persistent software
Prerequisites
- Sysmon deployed with Event IDs 12/13/14 (Registry), 19/20/21 (WMI), 1 (Process Creation)
- Windows Security Event forwarding for 4697 (Service Install), 4698 (Scheduled Task)
- EDR with registry and file monitoring capabilities
- PowerShell script block logging enabled (Event ID 4104)
- Autoruns or equivalent baseline of legitimate persistent entries
Workflow
- Enumerate Known Persistence Locations: Build a comprehensive list of Windows persistence points (Run keys, services, scheduled tasks, WMI, startup folder, DLL search order, COM hijacks, AppInit DLLs, Image File Execution Options).
- Collect Endpoint Data: Use EDR, Sysmon, or Velociraptor to collect current persistence artifacts from endpoints across the environment.
- Baseline Legitimate Persistence: Compare collected data against known-good baselines (Autoruns snapshots, GPO-deployed entries, SCCM configurations).
- Identify Anomalies: Flag new, unsigned, or unknown entries in persistence locations that deviate from the baseline.
- Investigate Suspicious Entries: For each anomaly, examine the binary it points to, its digital signature, file hash, and creation timestamp.
- Correlate with Process Activity: Link persistence entries to process execution, network activity, and user login events.
- Document and Remediate: Record findings, remove malicious persistence, and update detection rules.
Key Concepts
| Concept | Description |
|---|---|
| T1547.001 | Registry Run Keys / Startup Folder |
| T1543.003 | Windows Service (Create or Modify) |
| T1053.005 | Scheduled Task |
| T1546.003 | WMI Event Subscription |
| T1546.015 | Component Object Model (COM) Hijacking |
| T1546.012 | Image File Execution Options Injection |
| T1546.010 | AppInit DLLs |
| T1547.004 | Winlogon Helper DLL |
| T1547.005 | Security Support Provider |
| T1574.001 | DLL Search Order Hijacking |
| TA0003 | Persistence Tactic |
| Autoruns | Sysinternals tool showing persistent entries |
Tools & Systems
| Tool | Purpose |
|---|---|
| Sysinternals Autoruns | Comprehensive persistence enumeration |
| Velociraptor | Endpoint-wide persistence artifact collection |
| CrowdStrike Falcon | Real-time persistence monitoring |
| Sysmon | Registry and WMI event monitoring |
| OSQuery | SQL-based persistence queries |
| RECmd | Registry Explorer for forensic analysis |
| Splunk | SIEM correlation of persistence events |
Common Scenarios
- Registry Run Key Backdoor: Malware adds
HKCU\Software\Microsoft\Windows\CurrentVersion\Runentry pointing to payload in%APPDATA%. - WMI Event Subscription: Adversary creates WMI consumer/filter pair that executes PowerShell on system boot.
- Malicious Service: Attacker creates Windows service with
sc createpointing to a backdoor binary. - COM Object Hijack: Legitimate COM CLSID InprocServer32 path replaced with malicious DLL.
- IFEO Debugger Injection: Image File Execution Options key set with debugger pointing to implant for common utilities.
Output Format
Hunt ID: TH-PERSIST-[DATE]-[SEQ]
Persistence Type: [Registry/Service/Task/WMI/COM/Other]
MITRE Technique: T1547.xxx / T1543.xxx / T1053.xxx
Location: [Full registry key / service name / task path]
Value: [Binary path / command line]
Host(s): [Affected endpoints]
Signed: [Yes/No]
Hash: [SHA256]
Creation Time: [Timestamp]
Risk Level: [Critical/High/Medium/Low]
Verdict: [Malicious/Suspicious/Benign]
Frequently asked questions about Hunting for Windows Persistence
Similar skills
Asset Criticality Scoring for Vulns
Prioritize vulnerabilities based on asset criticality.
Performing Alert Triage with Elastic SIEM
Streamline alert triage processes in Elastic Security.
Active Directory Vulnerability Assessment
Secure your Active Directory with comprehensive assessments.
Active Directory Investigation
Streamline your Active Directory compromise investigations.
Parsing Artifacts with Eric Zimmerman Tools
Efficiently parse Windows forensic artifacts for analysis.
Operationalizing MISP Threat Feeds
Enhance threat detection with curated MISP feeds.