Persistence skills

Exploiting AWS with Pacu

mukul975

Streamline AWS penetration testing with Pacu.

Hunting for Suspicious Scheduled Tasks

mukul975

Identify and analyze potential persistence threats in Windows.

Hunting For Registry Persistence

mukul975

Proactively detect Windows registry persistence mechanisms.

Detecting Email Forwarding Rules Attack

mukul975

Hunt for malicious email forwarding rules effectively.

Hunting For Scheduled Task Persistence

mukul975

Proactively hunt for Windows scheduled task threats.

Hunting For Webshell Activity

mukul975

Proactively detect web shell threats on servers.

Cache Management

jeremylongshore

Efficiently manage your hyperflow memory entries.

Event Store Design

wshobson

Design and implement robust event stores for your applications.

Detecting WMI Persistence

mukul975

Identify and analyze WMI-based persistence mechanisms.

Detecting Malicious Scheduled Tasks

mukul975

Identify and analyze malicious tasks in Windows systems.

DNS Persistence Hunting

mukul975

Detect and analyze DNS-based persistence mechanisms.

Hunting for T1098 Account Manipulation

mukul975

Detect and analyze account manipulation in Active Directory.

Hunting for Unusual Service Installations

mukul975

Detect and analyze suspicious Windows service installations.

Startup Folder Persistence Detection

mukul975

Monitor Windows startup folders for suspicious activity.

Detect MITRE ATT&CK T1547.001 registry Run key persistence by analyzing Sysmon Event ID 13 logs and registry queries to identify malicious auto-start entries.

Systematically hunts for adversary persistence mechanisms across Windows endpoints, covering registry Run/RunOnce keys, services, startup folders, scheduled tasks, and WMI event subscriptions. Use when performing a broad persistence sweep during incident response or building SIEM detections that cover the full range of Windows persistence techniques (MITRE T1547).

Systematically map and remove malware, backdoors, and attacker persistence mechanisms (registry Run keys, scheduled tasks, WMI subscriptions, services, cron/init.d) from infected Windows and Linux systems using Autoruns, EDR/AV, and YARA, restoring a clean state while preventing re-infection. Use after containment and forensic analysis have identified all compromised systems and persistence mechanisms and you are ready to eradicate and recover.

Use Sysinternals Autoruns to systematically enumerate and analyze malware persistence mechanisms across Windows registry run keys, scheduled tasks, services, drivers, and startup locations. Use when hunting for persistence during Windows incident response, triaging a compromised endpoint, or validating that malware autostart entries have been fully identified and removed.