[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6ETWTBXK4K828DP8A8Z46FP":3,"skill-same:01M6ETWTBXK4K828DP8A8Z46FP":128},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":71,"commitSha":72,"skillDirectory":73,"forksCount":14,"repositoryHtmlUrl":74,"repositoryHomepageUrl":75,"ownerHtmlUrl":76,"ownerBlogUrl":6,"ownerDescription":77,"updatedAt":78,"install":79,"resources":92},"01M6ETWTBXK4K828DP8A8Z46FP","hunting-for-registry-persistence-mechanisms",null,"Hunt for registry-based persistence mechanisms including Run keys, Winlogon modifications, IFEO injection, and COM hijacking in Windows environments.","henriquescastilho\u002Fmy-claude","henriquescastilho","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F153296945?v=4","01M6ESH7EXPXTH9CVQ4K16SRG8","Henrique Scheer","01M6ESH7JHEK2PTNNH4HEH787Z",0,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fhunting-for-registry-persistence-mechanisms\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"registry","persistence","hunting for registry persistence mechanisms","execution","de","id","hunt","conversion","cm","format","analysis","injection","cybersecurity","detection","threat-hunting","mitre-attack","file","validation","run","windows","2026-11-10 10:12:30",false,"---\nname: hunting-for-registry-persistence-mechanisms\ndescription: Hunt for registry-based persistence mechanisms including Run keys, Winlogon\n  modifications, IFEO injection, and COM hijacking in Windows environments.\ndomain: cybersecurity\nsubdomain: threat-hunting\ntags:\n- threat-hunting\n- mitre-attack\n- registry\n- persistence\n- windows\n- t1547\n- proactive-detection\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nd3fend_techniques:\n- Executable Denylisting\n- Execution Isolation\n- File Metadata Consistency Validation\n- Content Format Conversion\n- File Content Analysis\nnist_csf:\n- DE.CM-01\n- DE.AE-02\n- DE.AE-07\n- ID.RA-05\nmitre_attack:\n- T1046\n- T1057\n- T1082\n- T1083\n- T1547\n---\n\n# Hunting For Registry Persistence Mechanisms\n\n## When to Use\n\n- When proactively hunting for indicators of hunting for registry persistence mechanisms in the environment\n- After threat intelligence indicates active campaigns using these techniques\n- During incident response to scope compromise related to these techniques\n- When EDR or SIEM alerts trigger on related indicators\n- During periodic security assessments and purple team exercises\n\n## Prerequisites\n\n- EDR platform with process and network telemetry (CrowdStrike, MDE, SentinelOne)\n- SIEM with relevant log data ingested (Splunk, Elastic, Sentinel)\n- Sysmon deployed with comprehensive configuration\n- Windows Security Event Log forwarding enabled\n- Threat intelligence feeds for IOC correlation\n\n## Workflow\n\n1. **Formulate Hypothesis**: Define a testable hypothesis based on threat intelligence or ATT&CK gap analysis.\n2. **Identify Data Sources**: Determine which logs and telemetry are needed to validate or refute the hypothesis.\n3. **Execute Queries**: Run detection queries against SIEM and EDR platforms to collect relevant events.\n4. **Analyze Results**: Examine query results for anomalies, correlating across multiple data sources.\n5. **Validate Findings**: Distinguish true positives from false positives through contextual analysis.\n6. **Correlate Activity**: Link findings to broader attack chains and threat actor TTPs.\n7. **Document and Report**: Record findings, update detection rules, and recommend response actions.\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| T1547.001 | Registry Run Keys |\n| T1547.004 | Winlogon Helper DLL |\n| T1546.012 | IFEO Injection |\n| T1546.015 | COM Hijacking |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| CrowdStrike Falcon | EDR telemetry and threat detection |\n| Microsoft Defender for Endpoint | Advanced hunting with KQL |\n| Splunk Enterprise | SIEM log analysis with SPL queries |\n| Elastic Security | Detection rules and investigation timeline |\n| Sysmon | Detailed Windows event monitoring |\n| Velociraptor | Endpoint artifact collection and hunting |\n| Sigma Rules | Cross-platform detection rule format |\n\n## Common Scenarios\n\n1. **Scenario 1**: Malware adding HKCU Run key for user-level persistence\n2. **Scenario 2**: Adversary modifying Winlogon Shell for system-level persistence\n3. **Scenario 3**: IFEO debugger injection for accessibility feature backdoor\n4. **Scenario 4**: COM object InprocServer32 hijack for DLL loading\n\n## Output Format\n\n```\nHunt ID: TH-HUNTIN-[DATE]-[SEQ]\nTechnique: T1547.001\nHost: [Hostname]\nUser: [Account context]\nEvidence: [Log entries, process trees, network data]\nRisk Level: [Critical\u002FHigh\u002FMedium\u002FLow]\nConfidence: [High\u002FMedium\u002FLow]\nRecommended Action: [Containment, investigation, monitoring]\n```\n","# Hunting For Registry Persistence Mechanisms\n\n## When to Use\n\n- When proactively hunting for indicators of hunting for registry persistence mechanisms in the environment\n- After threat intelligence indicates active campaigns using these techniques\n- During incident response to scope compromise related to these techniques\n- When EDR or SIEM alerts trigger on related indicators\n- During periodic security assessments and purple team exercises\n\n## Prerequisites\n\n- EDR platform with process and network telemetry (CrowdStrike, MDE, SentinelOne)\n- SIEM with relevant log data ingested (Splunk, Elastic, Sentinel)\n- Sysmon deployed with comprehensive configuration\n- Windows Security Event Log forwarding enabled\n- Threat intelligence feeds for IOC correlation\n\n## Workflow\n\n1. **Formulate Hypothesis**: Define a testable hypothesis based on threat intelligence or ATT&CK gap analysis.\n2. **Identify Data Sources**: Determine which logs and telemetry are needed to validate or refute the hypothesis.\n3. **Execute Queries**: Run detection queries against SIEM and EDR platforms to collect relevant events.\n4. **Analyze Results**: Examine query results for anomalies, correlating across multiple data sources.\n5. **Validate Findings**: Distinguish true positives from false positives through contextual analysis.\n6. **Correlate Activity**: Link findings to broader attack chains and threat actor TTPs.\n7. **Document and Report**: Record findings, update detection rules, and recommend response actions.\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| T1547.001 | Registry Run Keys |\n| T1547.004 | Winlogon Helper DLL |\n| T1546.012 | IFEO Injection |\n| T1546.015 | COM Hijacking |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| CrowdStrike Falcon | EDR telemetry and threat detection |\n| Microsoft Defender for Endpoint | Advanced hunting with KQL |\n| Splunk Enterprise | SIEM log analysis with SPL queries |\n| Elastic Security | Detection rules and investigation timeline |\n| Sysmon | Detailed Windows event monitoring |\n| Velociraptor | Endpoint artifact collection and hunting |\n| Sigma Rules | Cross-platform detection rule format |\n\n## Common Scenarios\n\n1. **Scenario 1**: Malware adding HKCU Run key for user-level persistence\n2. **Scenario 2**: Adversary modifying Winlogon Shell for system-level persistence\n3. **Scenario 3**: IFEO debugger injection for accessibility feature backdoor\n4. **Scenario 4**: COM object InprocServer32 hijack for DLL loading\n\n## Output Format\n\n```\nHunt ID: TH-HUNTIN-[DATE]-[SEQ]\nTechnique: T1547.001\nHost: [Hostname]\nUser: [Account context]\nEvidence: [Log entries, process trees, network data]\nRisk Level: [Critical\u002FHigh\u002FMedium\u002FLow]\nConfidence: [High\u002FMedium\u002FLow]\nRecommended Action: [Containment, investigation, monitoring]\n```\n",{"name":5,"tags":49,"author":52,"domain":36,"license":15,"version":53,"nist_csf":54,"subdomain":38,"description":7,"mitre_attack":59,"d3fend_techniques":65},[38,39,24,25,43,50,51],"t1547","proactive-detection","mahipal","1.0",[55,56,57,58],"DE.CM-01","DE.AE-02","DE.AE-07","ID.RA-05",[60,61,62,63,64],"T1046","T1057","T1082","T1083","T1547",[66,67,68,69,70],"Executable Denylisting","Execution Isolation","File Metadata Consistency Validation","Content Format Conversion","File Content Analysis","main","7925716f065257435fdb12e97f7e52842147d5ad",".claude\u002Fskills\u002Fhunting-for-registry-persistence-mechanisms","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude","https:\u002F\u002Fclaude.com\u002Fclaude-code","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho","Software · Applied AI · Quantitative Modeling · Building with Claude.","2026-06-10 12:24:46",{"source":8,"skillName":5,"commands":80,"prompt":90,"zipAvailable":91},[81,84,87],{"tool":82,"command":83},"npx","npx skills add henriquescastilho\u002Fmy-claude --skill hunting-for-registry-persistence-mechanisms",{"tool":85,"command":86},"bunx","bunx skills add henriquescastilho\u002Fmy-claude --skill hunting-for-registry-persistence-mechanisms",{"tool":88,"command":89},"pnpm","pnpm dlx skills add henriquescastilho\u002Fmy-claude --skill hunting-for-registry-persistence-mechanisms","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fhunting-for-registry-persistence-mechanisms\u002FSKILL.md",true,[93,99,104,110,114,118,124],{"path":94,"resourceType":95,"resourceTypeDesc":96,"sizeBytes":97,"sourceHtmlUrl":98},"assets\u002Ftemplate.md","ASSET","资产文件",2688,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fhunting-for-registry-persistence-mechanisms\u002Fassets\u002Ftemplate.md",{"path":100,"resourceType":100,"resourceTypeDesc":101,"sizeBytes":102,"sourceHtmlUrl":103},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fhunting-for-registry-persistence-mechanisms\u002FLICENSE",{"path":105,"resourceType":106,"resourceTypeDesc":107,"sizeBytes":108,"sourceHtmlUrl":109},"references\u002Fapi-reference.md","REFERENCE","参考文档",1876,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fhunting-for-registry-persistence-mechanisms\u002Freferences\u002Fapi-reference.md",{"path":111,"resourceType":106,"resourceTypeDesc":107,"sizeBytes":112,"sourceHtmlUrl":113},"references\u002Fstandards.md",1665,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fhunting-for-registry-persistence-mechanisms\u002Freferences\u002Fstandards.md",{"path":115,"resourceType":106,"resourceTypeDesc":107,"sizeBytes":116,"sourceHtmlUrl":117},"references\u002Fworkflows.md",2977,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fhunting-for-registry-persistence-mechanisms\u002Freferences\u002Fworkflows.md",{"path":119,"resourceType":120,"resourceTypeDesc":121,"sizeBytes":122,"sourceHtmlUrl":123},"scripts\u002Fagent.py","SCRIPT","脚本",5864,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fhunting-for-registry-persistence-mechanisms\u002Fscripts\u002Fagent.py",{"path":125,"resourceType":120,"resourceTypeDesc":121,"sizeBytes":126,"sourceHtmlUrl":127},"scripts\u002Fprocess.py",3694,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fhunting-for-registry-persistence-mechanisms\u002Fscripts\u002Fprocess.py",[129,170,179,188,210,234],{"skillNo":130,"name":131,"nameZh":6,"description":132,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":133,"licenseFileUrl":6,"sourceHtmlUrl":134,"categories":135,"keywords":150,"publishedAt":44},"01M6F0B6XPQ65AX2X0DWK8KT3E","markitdown","Convert files and office documents to Markdown. Supports PDF, DOCX, PPTX, XLSX, images (with OCR), audio (with transcription), HTML, CSV, JSON, XML, ZIP, YouTube URLs, EPubs and more.","MIT","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-writer\u002Fskills\u002Fmarkitdown\u002FSKILL.md",[136,139,142,145],{"categoryNo":137,"categoryName":138,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000002","文档处理",{"categoryNo":140,"categoryName":141,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000003","演示文稿",{"categoryNo":143,"categoryName":144,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000004","电子表格",{"categoryNo":146,"categoryName":147,"taxonomyType":148,"taxonomyTypeDesc":149},"01JBSEEDCAT000000000000034","行政与办公人员","PROFESSION","适用职业",[131,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166,167,168,169],"docx","PDF","pptx","xlsx","documents","csv","ocr","Audio","Bash","markdown","convert","read","write","edit","html","images","files","youtube","with",{"skillNo":171,"name":131,"nameZh":6,"description":132,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":133,"licenseFileUrl":6,"sourceHtmlUrl":172,"categories":173,"keywords":178,"publishedAt":44},"01M6F06SBHR9F0SDWE282Y8075","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-writer\u002Fscientific_writer\u002F.claude\u002Fskills\u002Fmarkitdown\u002FSKILL.md",[174,175,176,177],{"categoryNo":137,"categoryName":138,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":140,"categoryName":141,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":143,"categoryName":144,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":146,"categoryName":147,"taxonomyType":148,"taxonomyTypeDesc":149},[131,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166,167,168,169],{"skillNo":180,"name":131,"nameZh":6,"description":132,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":133,"licenseFileUrl":6,"sourceHtmlUrl":181,"categories":182,"keywords":187,"publishedAt":44},"01M6F02D4R14EJAPBWVDF9J9VQ","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-writer\u002F.claude\u002Fskills\u002Fmarkitdown\u002FSKILL.md",[183,184,185,186],{"categoryNo":137,"categoryName":138,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":140,"categoryName":141,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":143,"categoryName":144,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":146,"categoryName":147,"taxonomyType":148,"taxonomyTypeDesc":149},[131,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166,167,168,169],{"skillNo":189,"name":190,"nameZh":6,"description":191,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":133,"licenseFileUrl":6,"sourceHtmlUrl":192,"categories":193,"keywords":194,"publishedAt":44},"01M6F000KS6YB4MKS774G4R8ND","zarr-python","Chunked N-D arrays for cloud storage. Compressed arrays, parallel I\u002FO, S3\u002FGCS integration, NumPy\u002FDask\u002FXarray compatible, for large-scale scientific computing pipelines.","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-skills\u002Fscientific-skills\u002Fzarr-python\u002FSKILL.md",[],[195,196,197,198,199,200,201,202,203,204,205,206,207,208,209],"python","zarr python","storage","integration","s3","gcs","cloud","dask","parallel","pipelines","arrays","numpy","scientific computing","scale","scientific",{"skillNo":211,"name":212,"nameZh":6,"description":213,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":133,"licenseFileUrl":6,"sourceHtmlUrl":214,"categories":215,"keywords":217,"publishedAt":44},"01M6EZZJWFXM1GR78KTW6J0DN8","what-if-oracle","Run structured What-If scenario analysis with multi-branch possibility exploration. Use this skill when the user asks speculative questions like \"what if...\", \"what would happen if...\", \"what are the possibilities\", \"explore scenarios\", \"scenario analysis\", \"possibility space\", \"what could go wrong\", \"best case \u002F worst case\", \"risk analysis\", \"contingency planning\", \"strategic options\", or any question about uncertain futures. Also trigger when the user faces a fork-in-the-road decision, wants to stress-test an idea, or needs to think through consequences before committing.","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-skills\u002Fscientific-skills\u002Fwhat-if-oracle\u002FSKILL.md",[216],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[218,219,220,42,221,222,34,223,224,225,226,162,163,227,228,229,230,231,232,233],"oracle","what if oracle","go","ux","futures","explore","decision","branch","question","idea","exploration","options","stress-test","strategies","scenario","stress",{"skillNo":235,"name":236,"nameZh":6,"description":237,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":133,"licenseFileUrl":6,"sourceHtmlUrl":238,"categories":239,"keywords":250,"publishedAt":44},"01M6EZZCXAEB49RXGQCJX5E8GB","venue-templates","Access comprehensive LaTeX templates, formatting requirements, and submission guidelines for major scientific publication venues (Nature, Science, PLOS, IEEE, ACM), academic conferences (NeurIPS, ICML, CVPR, CHI), research posters, and grant proposals (NSF, NIH, DOE, DARPA). This skill should be used when preparing manuscripts for journal submission, conference papers, research posters, or grant proposals and need venue-specific formatting requirements and templates.","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-skills\u002Fscientific-skills\u002Fvenue-templates\u002FSKILL.md",[240,243,246,247],{"categoryNo":241,"categoryName":242,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000018","写作与文案",{"categoryNo":244,"categoryName":245,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000021","资料检索与研究",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":248,"categoryName":249,"taxonomyType":148,"taxonomyTypeDesc":149},"01JBSEEDCAT000000000000036","内容创作者",[251,252,253,254,255,256,257,258,159,259,162,163,164,260,261,262,263,264,209,265],"templates","venue templates","research","guidelines","NeurIPS","ICML","LaTeX","science","access","proposals","Academic","requirements","formatting","journal","chi"]