[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6HBSP32PVMPY5KXH83PDND6":3,"skill-same:01M6HBSP32PVMPY5KXH83PDND6":120},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":39,"linkOnly":40,"markdownContent":41,"markdownBody":42,"frontMatter":43,"refName":67,"commitSha":68,"skillDirectory":69,"forksCount":70,"repositoryHtmlUrl":71,"repositoryHomepageUrl":6,"ownerHtmlUrl":72,"ownerBlogUrl":6,"ownerDescription":73,"updatedAt":74,"install":75,"resources":88},"01M6HBSP32PVMPY5KXH83PDND6","analyzing-malware-persistence-with-autoruns",null,"Use Sysinternals Autoruns to systematically identify and analyze malware persistence mechanisms across registry keys, scheduled tasks, services, drivers, and startup locations on Windows systems.","HenriqueMC17\u002Fagente-core","HenriqueMC17","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F206460478?v=4","01M6HB63HBBF18AC4H09XTB549","Henrique Monteiro Cardoso","01M6HB63NGSQXWKWCFWW2B20W0",1,"Apache-2.0","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fanalyzing-malware-persistence-with-autoruns\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38],"persistence","malware","autoruns","analyzing malware persistence with autoruns","analyzing","with","T1547.001","scheduled","consistency","incident","cm","use","malware-persistence","analysis","T1543.003","cybersecurity","execution","t1574","file","windows","2026-11-10 10:12:30",false,"---\nname: analyzing-malware-persistence-with-autoruns\ndescription: Use Sysinternals Autoruns to systematically identify and analyze malware persistence mechanisms across registry keys, scheduled tasks, services, drivers, and startup locations on Windows systems.\ndomain: cybersecurity\nsubdomain: malware-analysis\ntags:\n- autoruns\n- persistence\n- malware-analysis\n- sysinternals\n- windows\n- registry\n- startup\n- incident-response\nmitre_attack:\n- T1547.001\n- T1543.003\n- T1053.005\n- T1574.001\n- T1037.001\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nd3fend_techniques:\n- Executable Denylisting\n- Execution Isolation\n- File Metadata Consistency Validation\n- Content Format Conversion\n- File Content Analysis\nnist_csf:\n- DE.AE-02\n- RS.AN-03\n- ID.RA-01\n- DE.CM-01\ncategory: analyzing-malware-persistence-with-autoruns\n---\n# Analyzing Malware Persistence with Autoruns\n\n## Overview\n\nSysinternals Autoruns extracts data from hundreds of Auto-Start Extensibility Points (ASEPs) on Windows, scanning 18+ categories including Run\u002FRunOnce keys, services, scheduled tasks, drivers, Winlogon entries, LSA providers, print monitors, WMI subscriptions, and AppInit DLLs. Digital signature verification filters Microsoft-signed entries. The compare function identifies newly added persistence via baseline diffing. VirusTotal integration checks hash reputation. Offline analysis via -z flag enables forensic disk image examination.\n\n\n## When to Use\n\n- When investigating security incidents that require analyzing malware persistence with autoruns\n- When building detection rules or threat hunting queries for this domain\n- When SOC analysts need structured procedures for this analysis type\n- When validating security monitoring coverage for related attack techniques\n\n## Prerequisites\n\n- Sysinternals Autoruns (GUI) and Autorunsc (CLI)\n- Administrative privileges on target system\n- Python 3.9+ for automated analysis\n- VirusTotal API key for reputation checks\n- Clean baseline export for comparison\n\n## Workflow\n\n### Step 1: Automated Persistence Scanning\n\n```python\n#!\u002Fusr\u002Fbin\u002Fenv python3\n\"\"\"Automate Autoruns-based persistence analysis.\"\"\"\nimport subprocess\nimport csv\nimport json\nimport sys\n\n\ndef scan_and_analyze(autorunsc_path=\"autorunsc64.exe\", csv_path=\"scan.csv\"):\n    cmd = [autorunsc_path, \"-a\", \"*\", \"-c\", \"-h\", \"-s\", \"-nobanner\", \"*\"]\n    result = subprocess.run(cmd, capture_output=True, text=True, timeout=600)\n    with open(csv_path, 'w') as f:\n        f.write(result.stdout)\n    return parse_and_flag(csv_path)\n\n\ndef parse_and_flag(csv_path):\n    suspicious = []\n    with open(csv_path, 'r', errors='replace') as f:\n        for row in csv.DictReader(f):\n            reasons = []\n            signer = row.get(\"Signer\", \"\")\n            if not signer or signer == \"(Not verified)\":\n                reasons.append(\"Unsigned binary\")\n            if not row.get(\"Description\") and not row.get(\"Company\"):\n                reasons.append(\"Missing metadata\")\n            path = row.get(\"Image Path\", \"\").lower()\n            for sp in [\"\\temp\\\\\", \"\\appdata\\local\\temp\", \"\\users\\public\\\\\"]:\n                if sp in path:\n                    reasons.append(f\"Suspicious path\")\n            launch = row.get(\"Launch String\", \"\").lower()\n            for kw in [\"powershell\", \"cmd \u002Fc\", \"wscript\", \"mshta\", \"regsvr32\"]:\n                if kw in launch:\n                    reasons.append(f\"LOLBin: {kw}\")\n            if reasons:\n                row[\"reasons\"] = reasons\n                suspicious.append(row)\n    return suspicious\n\n\nif __name__ == \"__main__\":\n    if len(sys.argv) > 1:\n        results = parse_and_flag(sys.argv[1])\n        print(f\"[!] {len(results)} suspicious entries\")\n        for r in results:\n            print(f\"  {r.get('Entry','')} - {r.get('Image Path','')}\")\n            for reason in r.get('reasons', []):\n                print(f\"    - {reason}\")\n```\n\n## Validation Criteria\n\n- All ASEP categories scanned and cataloged\n- Unsigned entries flagged for investigation\n- Suspicious paths and LOLBin launch strings highlighted\n- Baseline comparison identifies new persistence mechanisms\n\n## References\n\n- [Sysinternals Autoruns](https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fsysinternals\u002Fdownloads\u002Fautoruns)\n- [SANS - Offline Autoruns Revisited](https:\u002F\u002Fwww.sans.org\u002Fblog\u002Foffline-autoruns-revisited-auditing-malware-persistence\u002F)\n- [Hunting Malware with Autoruns](https:\u002F\u002Fnasbench.medium.com\u002Fhunting-malware-with-windows-sysinternals-autoruns-19cbfe4103c2)\n- [MITRE ATT&CK T1547 - Boot or Logon Autostart](https:\u002F\u002Fattack.mitre.org\u002Ftechniques\u002FT1547\u002F)\n","# Analyzing Malware Persistence with Autoruns\n\n## Overview\n\nSysinternals Autoruns extracts data from hundreds of Auto-Start Extensibility Points (ASEPs) on Windows, scanning 18+ categories including Run\u002FRunOnce keys, services, scheduled tasks, drivers, Winlogon entries, LSA providers, print monitors, WMI subscriptions, and AppInit DLLs. Digital signature verification filters Microsoft-signed entries. The compare function identifies newly added persistence via baseline diffing. VirusTotal integration checks hash reputation. Offline analysis via -z flag enables forensic disk image examination.\n\n\n## When to Use\n\n- When investigating security incidents that require analyzing malware persistence with autoruns\n- When building detection rules or threat hunting queries for this domain\n- When SOC analysts need structured procedures for this analysis type\n- When validating security monitoring coverage for related attack techniques\n\n## Prerequisites\n\n- Sysinternals Autoruns (GUI) and Autorunsc (CLI)\n- Administrative privileges on target system\n- Python 3.9+ for automated analysis\n- VirusTotal API key for reputation checks\n- Clean baseline export for comparison\n\n## Workflow\n\n### Step 1: Automated Persistence Scanning\n\n```python\n#!\u002Fusr\u002Fbin\u002Fenv python3\n\"\"\"Automate Autoruns-based persistence analysis.\"\"\"\nimport subprocess\nimport csv\nimport json\nimport sys\n\n\ndef scan_and_analyze(autorunsc_path=\"autorunsc64.exe\", csv_path=\"scan.csv\"):\n    cmd = [autorunsc_path, \"-a\", \"*\", \"-c\", \"-h\", \"-s\", \"-nobanner\", \"*\"]\n    result = subprocess.run(cmd, capture_output=True, text=True, timeout=600)\n    with open(csv_path, 'w') as f:\n        f.write(result.stdout)\n    return parse_and_flag(csv_path)\n\n\ndef parse_and_flag(csv_path):\n    suspicious = []\n    with open(csv_path, 'r', errors='replace') as f:\n        for row in csv.DictReader(f):\n            reasons = []\n            signer = row.get(\"Signer\", \"\")\n            if not signer or signer == \"(Not verified)\":\n                reasons.append(\"Unsigned binary\")\n            if not row.get(\"Description\") and not row.get(\"Company\"):\n                reasons.append(\"Missing metadata\")\n            path = row.get(\"Image Path\", \"\").lower()\n            for sp in [\"\\temp\\\\\", \"\\appdata\\local\\temp\", \"\\users\\public\\\\\"]:\n                if sp in path:\n                    reasons.append(f\"Suspicious path\")\n            launch = row.get(\"Launch String\", \"\").lower()\n            for kw in [\"powershell\", \"cmd \u002Fc\", \"wscript\", \"mshta\", \"regsvr32\"]:\n                if kw in launch:\n                    reasons.append(f\"LOLBin: {kw}\")\n            if reasons:\n                row[\"reasons\"] = reasons\n                suspicious.append(row)\n    return suspicious\n\n\nif __name__ == \"__main__\":\n    if len(sys.argv) > 1:\n        results = parse_and_flag(sys.argv[1])\n        print(f\"[!] {len(results)} suspicious entries\")\n        for r in results:\n            print(f\"  {r.get('Entry','')} - {r.get('Image Path','')}\")\n            for reason in r.get('reasons', []):\n                print(f\"    - {reason}\")\n```\n\n## Validation Criteria\n\n- All ASEP categories scanned and cataloged\n- Unsigned entries flagged for investigation\n- Suspicious paths and LOLBin launch strings highlighted\n- Baseline comparison identifies new persistence mechanisms\n\n## References\n\n- [Sysinternals Autoruns](https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fsysinternals\u002Fdownloads\u002Fautoruns)\n- [SANS - Offline Autoruns Revisited](https:\u002F\u002Fwww.sans.org\u002Fblog\u002Foffline-autoruns-revisited-auditing-malware-persistence\u002F)\n- [Hunting Malware with Autoruns](https:\u002F\u002Fnasbench.medium.com\u002Fhunting-malware-with-windows-sysinternals-autoruns-19cbfe4103c2)\n- [MITRE ATT&CK T1547 - Boot or Logon Autostart](https:\u002F\u002Fattack.mitre.org\u002Ftechniques\u002FT1547\u002F)\n",{"name":5,"tags":44,"author":50,"domain":34,"license":15,"version":51,"category":5,"nist_csf":52,"subdomain":45,"description":7,"mitre_attack":57,"d3fend_techniques":61},[21,19,45,46,38,47,48,49],"malware-analysis","sysinternals","registry","startup","incident-response","mahipal","1.0",[53,54,55,56],"DE.AE-02","RS.AN-03","ID.RA-01","DE.CM-01",[25,33,58,59,60],"T1053.005","T1574.001","T1037.001",[62,63,64,65,66],"Executable Denylisting","Execution Isolation","File Metadata Consistency Validation","Content Format Conversion","File Content Analysis","main","5eea5b3296f4673b5f481e8bcc1ba76281149f16","modules\u002Fanalyzing-malware-persistence-with-autoruns",0,"https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core","https:\u002F\u002Fgithub.com\u002FHenriqueMC17","Qualquer tecnologia suficientemente avançada é indistinguível da mágica.","2026-09-28 22:40:38",{"source":8,"skillName":5,"commands":76,"prompt":86,"zipAvailable":87},[77,80,83],{"tool":78,"command":79},"npx","npx skills add HenriqueMC17\u002Fagente-core --skill analyzing-malware-persistence-with-autoruns",{"tool":81,"command":82},"bunx","bunx skills add HenriqueMC17\u002Fagente-core --skill analyzing-malware-persistence-with-autoruns",{"tool":84,"command":85},"pnpm","pnpm dlx skills add HenriqueMC17\u002Fagente-core --skill analyzing-malware-persistence-with-autoruns","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fanalyzing-malware-persistence-with-autoruns\u002FSKILL.md",true,[89,95,100,106,110,114],{"path":90,"resourceType":91,"resourceTypeDesc":92,"sizeBytes":93,"sourceHtmlUrl":94},"assets\u002Ftemplate.md","ASSET","资产文件",424,"https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fanalyzing-malware-persistence-with-autoruns\u002Fassets\u002Ftemplate.md",{"path":96,"resourceType":96,"resourceTypeDesc":97,"sizeBytes":98,"sourceHtmlUrl":99},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fanalyzing-malware-persistence-with-autoruns\u002FLICENSE",{"path":101,"resourceType":102,"resourceTypeDesc":103,"sizeBytes":104,"sourceHtmlUrl":105},"references\u002Fapi-reference.md","REFERENCE","参考文档",1835,"https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fanalyzing-malware-persistence-with-autoruns\u002Freferences\u002Fapi-reference.md",{"path":107,"resourceType":102,"resourceTypeDesc":103,"sizeBytes":108,"sourceHtmlUrl":109},"references\u002Fstandards.md",312,"https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fanalyzing-malware-persistence-with-autoruns\u002Freferences\u002Fstandards.md",{"path":111,"resourceType":102,"resourceTypeDesc":103,"sizeBytes":112,"sourceHtmlUrl":113},"references\u002Fworkflows.md",471,"https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fanalyzing-malware-persistence-with-autoruns\u002Freferences\u002Fworkflows.md",{"path":115,"resourceType":116,"resourceTypeDesc":117,"sizeBytes":118,"sourceHtmlUrl":119},"scripts\u002Fagent.py","SCRIPT","脚本",5841,"https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fanalyzing-malware-persistence-with-autoruns\u002Fscripts\u002Fagent.py",[121,150,175,196,212,232],{"skillNo":122,"name":123,"nameZh":6,"description":124,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":125,"categories":126,"keywords":132,"publishedAt":39},"01M6HPFF0RCN0X6WT5EBSV71GY","validating-backup-integrity-for-recovery","Validate backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to ensure backups are reliable for disaster recovery and ransomware response scenarios.","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[127],{"categoryNo":128,"categoryName":129,"taxonomyType":130,"taxonomyTypeDesc":131},"01JBSEEDCAT000000000000008","测试与质量","SCENARIO","使用场景",[133,134,135,136,137,138,34,139,140,141,49,142,143,144,145,146,147,28,148,149],"integrity","backup","recovery","validating backup integrity for recovery","for","testing","validate","verification","hash-verification","ransomware","detection","t1078","t1490","disaster-recovery","restore","disaster recovery","ransomware response",{"skillNo":151,"name":152,"nameZh":6,"description":153,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":154,"categories":155,"keywords":156,"publishedAt":39},"01M6HPFAWJVFK25Q33K3T7WQ8G","triaging-vulnerabilities-with-ssvc-framework","Triage and prioritize vulnerabilities using CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree framework to produce actionable remediation priorities.","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[],[157,158,159,160,24,34,161,162,163,164,165,166,167,168,169,170,171,172,173,174],"vulnerabilities","framework","ssvc","triaging vulnerabilities with ssvc framework","triage and prioritize","CISA","vulnerability-management","risk-management","cvss","remediation","vulnerability","prioritization","decision-tree","prioritize","decision","priorities","actionable","tree",{"skillNo":176,"name":177,"nameZh":6,"description":178,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":179,"categories":180,"keywords":181,"publishedAt":39},"01M6HPF6JS9X72WP59094H3ASQ","triaging-security-incident","Performs initial triage of security incidents to determine severity, scope, and required response actions using the NIST SP 800-61r3 and SANS PICERL frameworks. Classifies incidents by type, assigns priority based on business impact, and routes...","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Ftriaging-security-incident\u002FSKILL.md",[],[182,183,28,34,184,185,186,144,145,32,187,188,189,190,191,192,193,194,195,27],"security","triaging security incident","actions","soc","NIST","severity-classification","incident-triage","SANS-PICERL","SOC-operations","picerl","conversion","isolation","scope","impact",{"skillNo":197,"name":198,"nameZh":6,"description":199,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":200,"categories":201,"keywords":202,"publishedAt":39},"01M6HPF2EX6ZYNYYHKBRJN7GEF","triaging-security-incident-with-ir-playbook","Classify and prioritize security incidents using structured IR playbooks to determine severity, assign response teams, and initiate appropriate response procedures.","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Ftriaging-security-incident-with-ir-playbook\u002FSKILL.md",[],[182,203,204,183,28,24,34,205,185,49,206,207,144,145,208,187,170,209,210,211],"playbook","triaging security incident with ir playbook","teams","IR-playbook","severity","classification","classify","incidents","initiate",{"skillNo":213,"name":214,"nameZh":6,"description":215,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":216,"categories":217,"keywords":218,"publishedAt":39},"01M6HPEY9XPGE7X95AG4XJFQAW","triaging-security-alerts-in-splunk","Triages security alerts in Splunk Enterprise Security by classifying severity, investigating notable events, correlating related telemetry, and making escalation or closure decisions using SPL queries and the Incident Review dashboard. Use when...","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Ftriaging-security-alerts-in-splunk\u002FSKILL.md",[],[182,219,220,221,222,223,34,224,225,226,185,227,144,228,229,230,190,29,28,231],"security alerts","splunk","triaging security alerts in splunk","alerts","review","siem","dashboard","search","correlation-search","t1566","notable-events","incident-review","de",{"skillNo":233,"name":234,"nameZh":6,"description":235,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":236,"categories":237,"keywords":238,"publishedAt":39},"01M6HPET6XGEPEJPN7V032JGZ0","tracking-threat-actor-infrastructure","Threat actor infrastructure tracking involves monitoring and mapping adversary-controlled assets including command-and-control (C2) servers, phishing domains, exploit kit hosts, bulletproof hosting, a","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Ftracking-threat-actor-infrastructure\u002FSKILL.md",[],[239,240,241,242,34,243,244,245,246,247,248,228,249,250,29,251,231,252,253,254],"infrastructure","tracking threat actor infrastructure","tracking","threat","monitoring","mitre-attack","threat-actor","threat-intelligence","command-and-control","dns","command","exploit","intelligence","domains","kit","hosts"]