Startup Folder Persistence Detection
FreeMonitor Windows startup folders for suspicious activity.
Free · Opens the source repo
What Startup Folder Persistence Detection does
The Startup Folder Persistence Detection skill is designed for security professionals who need to identify and investigate potential malware or unauthorized software that utilizes Windows startup folders for persistence. This skill leverages the MITRE ATT&CK framework, specifically technique T1547.001, which focuses on detecting malicious files that execute automatically during user login. By monitoring the startup directories, this skill helps in identifying files that may have been placed there by attackers to ensure their presence even after a system reboot.
The skill operates by scanning user and system startup folders located at %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup and C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup. It checks for suspicious file types, such as .bat, .vbs, .ps1, .lnk, and .exe, and flags any recently created files that could indicate a persistence implant. Additionally, it utilizes a Python watchdog script to provide real-time monitoring of these directories, alerting users to any new file creations as they occur.
This skill is particularly useful for SOC analysts and threat hunters who are tasked with investigating security incidents or validating security monitoring coverage. It generates a comprehensive JSON report that includes risk scores, file metadata, and indicators of suspicious activity, allowing users to correlate findings with known legitimate startup entries. By providing structured procedures for analyzing startup folder persistence, this skill enhances the overall effectiveness of threat detection and response efforts.
When to use it
Use this skill when investigating potential malware infections or validating security monitoring for startup folder persistence.
When not to use it
This skill may not be suitable for environments without Windows or for users not focused on startup persistence threats.
What you can build with it
Investigating Malware Incidents
Use this skill to identify and analyze suspicious files in startup folders during a malware investigation.
Validating Security Monitoring
Leverage the skill to ensure that your security monitoring covers startup folder persistence techniques.
Building Detection Rules
Utilize this skill to create detection rules and queries focused on startup folder persistence threats.
How to install Startup Folder Persistence Detection
View source1. Install with the skills CLI
npx skills add mukul975/anthropic-cybersecurity-skills/hunting-for-startup-folder-persistence --agent claude-code2. Or install it manually
Download the skill folder and drop it into ~/.claude/skills/ for all projects, or .claude/skills/ to scope it to one repo. Restart Claude Code so it picks up the new skill.
Anthropic's agentic coding CLI, and the reference implementation of Agent Skills. Drop a skill folder into ~/.claude/skills and Claude Code loads it automatically whenever a task matches the skill's description. Claude Code docs
Inside SKILL.md
Written by mukul975Hunting for Startup Folder Persistence
Overview
Attackers use Windows startup folders for persistence (MITRE ATT&CK T1547.001 — Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder). Files placed in %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup or C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup execute automatically at user logon. This skill scans startup directories for suspicious files, monitors for real-time changes using Python watchdog, and analyzes file metadata to detect persistence implants.
When to Use
- When investigating security incidents that require hunting for startup folder persistence
- When building detection rules or threat hunting queries for this domain
- When SOC analysts need structured procedures for this analysis type
- When validating security monitoring coverage for related attack techniques
Prerequisites
- Python 3.9+ with
watchdog,pefile(optional for PE analysis) - Access to Windows startup folders (user and all-users)
- Windows Event Logs for Event ID 4663 correlation (optional)
Steps
- Enumerate all files in user and system startup directories
- Analyze file types, creation timestamps, and digital signatures
- Flag suspicious file extensions (.bat, .vbs, .ps1, .lnk, .exe)
- Check for recently created files (< 7 days) as potential implants
- Monitor startup folders in real-time using watchdog FileSystemEventHandler
- Correlate with known legitimate startup entries
- Generate threat hunting report with T1547.001 MITRE mapping
Expected Output
- JSON report listing all startup folder contents with risk scores, file metadata, and suspicious indicators
- Real-time monitoring alerts for new file creation in startup directories
Frequently asked questions about Startup Folder Persistence Detection
Similar skills
Asset Criticality Scoring for Vulns
Prioritize vulnerabilities based on asset criticality.
Performing Alert Triage with Elastic SIEM
Streamline alert triage processes in Elastic Security.
Active Directory Vulnerability Assessment
Secure your Active Directory with comprehensive assessments.
Active Directory Investigation
Streamline your Active Directory compromise investigations.
Parsing Artifacts with Eric Zimmerman Tools
Efficiently parse Windows forensic artifacts for analysis.
Operationalizing MISP Threat Feeds
Enhance threat detection with curated MISP feeds.