[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71F38486DB8J7V2HK2G303P":3,"skill-same:01M71F38486DB8J7V2HK2G303P":96},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":39,"linkOnly":40,"markdownContent":41,"markdownBody":42,"frontMatter":43,"refName":69,"commitSha":70,"skillDirectory":71,"forksCount":14,"repositoryHtmlUrl":72,"repositoryHomepageUrl":6,"ownerHtmlUrl":73,"ownerBlogUrl":6,"ownerDescription":74,"updatedAt":75,"install":76,"resources":89},"01M71F38486DB8J7V2HK2G303P","analysis-forensic-collect",null,"Systematically investigate all persistence mechanisms on Windows and Linux systems to identify how malware survives reboots and maintains access.","DCx7C5\u002Fai-marketplace","DCx7C5","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42419559?v=4","01M71C01G2AZV3NTNGWAWSHJPP","DC","01M71C01GQW6G50S2BYMS7PP3E",0,"MIT","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fmalware\u002Fanalysis\u002Fforensic\u002Fcollect\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38],"forensic","collect","analysis forensic collect","analysis","digital-forensics","rootkit","scheduled-tasks","malware","registry","read","how","de","tasks","Bash","T1543.003","access","scheduled","cybersecurity","incident","T1547.001","2026-11-10 10:12:30",false,"---\nname: analysis-forensic-collect\ndescription: Systematically investigate all persistence mechanisms on Windows and Linux systems to identify how malware survives reboots and maintains access.\ndomain: cybersecurity\nsubdomain: digital-forensics\ntags:\n- forensics\n- malware-persistence\n- autoruns\n- registry\n- scheduled-tasks\n- rootkit-detection\n- incident-response\nnist_csf:\n- RS.AN-01\n- RS.AN-03\n- DE.AE-02\n- RS.MA-01\nmodel: sonnet\nmaxTurns: 20\ntools: [Read, Bash, Glob, Grep]\nmitre_attack:\n- T1547.001\n- T1053.005\n- T1543.003\n- T1546.003\n- T1574\n- T1014\n- T1059\n- T1547\ncapec: []\n---\n\n# Performing Malware Persistence Investigation\n\n## When to Use\n- When investigating how malware maintains presence on a compromised system after reboots\n- During incident response to identify all persistence mechanisms for complete remediation\n- For threat hunting to discover unauthorized autostart entries across endpoints\n- When analyzing malware behavior to understand its persistence strategy\n- For verifying that all persistence has been removed after incident remediation\n\n## Prerequisites\n- Forensic image or live system access with administrative privileges\n- Autoruns (Sysinternals) for Windows persistence enumeration\n- RegRipper for offline registry analysis\n- Understanding of Windows and Linux persistence mechanisms\n- YARA rules for scanning persistence locations\n- Baseline of known-good autorun entries for comparison\n\n## Workflow\n\n### Step 1: Enumerate Windows Registry Persistence\n\n```bash\n# Extract registry hives from forensic image\nmount -o ro,loop,offset=$((2048*512)) \u002Fcases\u002Fcase-2024-001\u002Fimages\u002Fevidence.dd \u002Fmnt\u002Fevidence\n\n# Key registry persistence locations\npython3 \u003C\u003C 'PYEOF'\nfrom Registry import Registry\nimport json\n\nresults = {'registry_persistence': []}\n\n# SYSTEM hive analysis\nsystem_reg = Registry.Registry(\"\u002Fcases\u002Fcase-2024-001\u002Fregistry\u002FSYSTEM\")\nselect = system_reg.open(\"Select\")\ncurrent = select.value(\"Current\").value()\ncs = f\"ControlSet{current:03d}\"\n\n# Services (very common persistence)\nservices = system_reg.open(f\"{cs}\\\\Services\")\nfor svc in services.subkeys():\n    try:\n        start_type = svc.value(\"Start\").value()\n        image_path = \"\"\n        try:\n            image_path = svc.value(\"ImagePath\").value()\n        except:\n            pass\n        # Start types: 0=Boot, 1=System, 2=Auto, 3=Manual, 4=Disabled\n        if start_type in (0, 1, 2) and image_path:\n            svc_type = svc.value(\"Type\").value() if svc.values() else 0\n            results['registry_persistence'].append({\n                'location': f'HKLM\\\\SYSTEM\\\\{cs}\\\\Services\\\\{svc.name()}',\n                'type': 'Service',\n                'value': image_path,\n                'start_type': start_type,\n                'timestamp': str(svc.timestamp())\n            })\n    except Exception:\n        pass\n\n# SOFTWARE hive analysis\nsw_reg = Registry.Registry(\"\u002Fcases\u002Fcase-2024-001\u002Fregistry\u002FSOFTWARE\")\n\n# Machine Run keys\nrun_keys = [\n    \"Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\",\n    \"Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce\",\n    \"Microsoft\\\\Windows\\\\CurrentVersion\\\\RunServices\",\n    \"Microsoft\\\\Windows\\\\CurrentVersion\\\\RunServicesOnce\",\n    \"Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\Explorer\\\\Run\",\n    \"Wow6432Node\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\",\n    \"Wow6432Node\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce\",\n]\n\nfor key_path in run_keys:\n    try:\n        key = sw_reg.open(key_path)\n        for value in key.values():\n            results['registry_persistence'].append({\n                'location': f'HKLM\\\\SOFTWARE\\\\{key_path}',\n                'type': 'Run Key',\n                'name': value.name(),\n                'value': str(value.value()),\n                'timestamp': str(key.timestamp())\n            })\n    except Exception:\n        pass\n\n# NTUSER.DAT analysis\nimport glob\nfor ntuser in glob.glob(\"\u002Fcases\u002Fcase-2024-001\u002Fregistry\u002FNTUSER*.DAT\"):\n    try:\n        user_reg = Registry.Registry(ntuser)\n        user_run_keys = [\n            \"Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\",\n            \"Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce\",\n            \"Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Explorer\\\\Shell Folders\\\\Startup\",\n        ]\n        for key_path in user_run_keys:\n            try:\n                key = user_reg.open(key_path)\n                for value in key.values():\n                    results['registry_persistence'].append({\n                        'location': f'HKCU\\\\{key_path}',\n                        'type': 'User Run Key',\n                        'name': value.name(),\n                        'value': str(value.value()),\n                        'timestamp': str(key.timestamp()),\n                        'hive': ntuser\n                    })\n            except Exception:\n                pass\n    except Exception:\n        pass\n\nprint(f\"Total registry persistence entries: {len(results['registry_persistence'])}\")\nfor entry in results['registry_persistence']:\n    print(f\"  [{entry['type']}] {entry.get('name', '')} -> {entry.get('value', '')[:100]}\")\n\nwith open('\u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fregistry_persistence.json', 'w') as f:\n    json.dump(results, f, indent=2)\nPYEOF\n```\n\n### Step 2: Check Scheduled Tasks and WMI Persistence\n\n```bash\n# Extract scheduled tasks from forensic image\nmkdir -p \u002Fcases\u002Fcase-2024-001\u002Fpersistence\u002Ftasks\u002F\ncp -r \u002Fmnt\u002Fevidence\u002FWindows\u002FSystem32\u002FTasks\u002F* \u002Fcases\u002Fcase-2024-001\u002Fpersistence\u002Ftasks\u002F 2>\u002Fdev\u002Fnull\n\n# Parse scheduled task XML files\npython3 \u003C\u003C 'PYEOF'\nimport os, xml.etree.ElementTree as ET\n\ntasks_dir = '\u002Fcases\u002Fcase-2024-001\u002Fpersistence\u002Ftasks\u002F'\nsuspicious_tasks = []\n\nfor root_dir, dirs, files in os.walk(tasks_dir):\n    for fname in files:\n        fpath = os.path.join(root_dir, fname)\n        try:\n            tree = ET.parse(fpath)\n            root = tree.getroot()\n            ns = {'t': 'http:\u002F\u002Fschemas.microsoft.com\u002Fwindows\u002F2004\u002F02\u002Fmit\u002Ftask'}\n\n            actions = root.findall('.\u002F\u002Ft:Exec', ns)\n            for action in actions:\n                command = action.find('t:Command', ns)\n                args = action.find('t:Arguments', ns)\n                cmd_text = command.text if command is not None else ''\n                args_text = args.text if args is not None else ''\n\n                # Flag suspicious commands\n                suspicious_indicators = [\n                    'powershell', 'cmd.exe', 'wscript', 'cscript', 'mshta',\n                    'regsvr32', 'rundll32', 'certutil', 'bitsadmin',\n                    '\u002Fc ', '-enc', '-e ', 'hidden', 'bypass', 'downloadstring',\n                    'invoke-', 'iex', '\u002Ftmp\u002F', 'appdata', 'programdata',\n                    'temp\\\\', '.ps1', '.vbs', '.hta', 'base64'\n                ]\n\n                is_suspicious = any(s in (cmd_text + ' ' + args_text).lower() for s in suspicious_indicators)\n\n                task_info = {\n                    'name': fname,\n                    'path': fpath.replace(tasks_dir, ''),\n                    'command': cmd_text,\n                    'arguments': args_text,\n                    'suspicious': is_suspicious\n                }\n\n                if is_suspicious:\n                    suspicious_tasks.append(task_info)\n                    print(f\"SUSPICIOUS TASK: {fname}\")\n                    print(f\"  Command: {cmd_text}\")\n                    print(f\"  Arguments: {args_text}\")\n                    print()\n\n        except Exception as e:\n            pass\n\nprint(f\"\\nTotal suspicious scheduled tasks: {len(suspicious_tasks)}\")\nPYEOF\n\n# Check WMI event subscriptions (common APT persistence)\n# WMI repository: C:\\Windows\\System32\\wbem\\Repository\\\ncp -r \u002Fmnt\u002Fevidence\u002FWindows\u002FSystem32\u002Fwbem\u002FRepository\u002F \u002Fcases\u002Fcase-2024-001\u002Fpersistence\u002Fwmi\u002F 2>\u002Fdev\u002Fnull\n\n# Parse WMI persistence using PyWMIPersistenceFinder\npython3 \u003C\u003C 'PYEOF'\nimport os, re\n\n# Search WMI OBJECTS.DATA for event subscriptions\nwmi_db = '\u002Fcases\u002Fcase-2024-001\u002Fpersistence\u002Fwmi\u002FOBJECTS.DATA'\nif os.path.exists(wmi_db):\n    with open(wmi_db, 'rb') as f:\n        data = f.read()\n\n    # Search for EventFilter strings\n    filters = re.findall(b'__EventFilter.*?(?=\\x00\\x00)', data)\n    consumers = re.findall(b'CommandLineEventConsumer.*?(?=\\x00\\x00)', data)\n    bindings = re.findall(b'__FilterToConsumerBinding.*?(?=\\x00\\x00)', data)\n\n    print(\"=== WMI PERSISTENCE ===\")\n    print(f\"Event Filters: {len(filters)}\")\n    print(f\"Command Consumers: {len(consumers)}\")\n    print(f\"Filter-Consumer Bindings: {len(bindings)}\")\n\n    for consumer in consumers:\n        decoded = consumer.decode('utf-8', errors='ignore')\n        print(f\"  Consumer: {decoded[:200]}\")\nelse:\n    print(\"WMI repository not found\")\nPYEOF\n```\n\n### Step 3: Check File System and Boot Persistence\n\n```bash\n# Startup folders\necho \"=== STARTUP FOLDER CONTENTS ===\" > \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fstartup_items.txt\n\nls -la \"\u002Fmnt\u002Fevidence\u002FProgramData\u002FMicrosoft\u002FWindows\u002FStart Menu\u002FPrograms\u002FStartup\u002F\" \\\n   >> \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fstartup_items.txt 2>\u002Fdev\u002Fnull\n\nfor userdir in \u002Fmnt\u002Fevidence\u002FUsers\u002F*\u002F; do\n    username=$(basename \"$userdir\")\n    echo \"--- User: $username ---\" >> \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fstartup_items.txt\n    ls -la \"$userdir\u002FAppData\u002FRoaming\u002FMicrosoft\u002FWindows\u002FStart Menu\u002FPrograms\u002FStartup\u002F\" \\\n       >> \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fstartup_items.txt 2>\u002Fdev\u002Fnull\ndone\n\n# Check DLL search order hijacking locations\necho \"=== DLL HIJACKING CHECK ===\" > \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fdll_hijack.txt\n# Check for DLLs in application directories that should only be in System32\nfind \u002Fmnt\u002Fevidence\u002FProgram\\ Files\u002F \u002Fmnt\u002Fevidence\u002FProgram\\ Files\\ \\(x86\\)\u002F \\\n   -name \"*.dll\" -newer \u002Fmnt\u002Fevidence\u002FWindows\u002FSystem32\u002Fntdll.dll 2>\u002Fdev\u002Fnull \\\n   >> \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fdll_hijack.txt\n\n# Check for COM object hijacking\npython3 \u003C\u003C 'PYEOF'\nfrom Registry import Registry\n\nreg = Registry.Registry(\"\u002Fcases\u002Fcase-2024-001\u002Fregistry\u002FSOFTWARE\")\n\n# Check for suspicious CLSID entries\ntry:\n    clsid = reg.open(\"Classes\\\\CLSID\")\n    for key in clsid.subkeys():\n        try:\n            server = key.subkey(\"InprocServer32\")\n            dll_path = server.value(\"(default)\").value()\n            if any(s in dll_path.lower() for s in ['temp', 'appdata', 'programdata', 'downloads', 'tmp']):\n                print(f\"SUSPICIOUS COM: {key.name()} -> {dll_path}\")\n        except:\n            pass\nexcept:\n    pass\nPYEOF\n\n# Check boot configuration for bootkits\n# BCD (Boot Configuration Data)\nls -la \u002Fmnt\u002Fevidence\u002FBoot\u002FBCD 2>\u002Fdev\u002Fnull\n# Check for modified bootmgr or winload.exe\nsha256sum \u002Fmnt\u002Fevidence\u002FWindows\u002FSystem32\u002Fwinload.exe 2>\u002Fdev\u002Fnull\n```\n\n### Step 4: Check Linux Persistence Mechanisms\n\n```bash\n# If analyzing a Linux system\nLINUX_ROOT=\"\u002Fmnt\u002Fevidence\"\n\necho \"=== LINUX PERSISTENCE CHECK ===\" > \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flinux_persistence.txt\n\n# Cron jobs\necho \"--- Cron Jobs ---\" >> \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flinux_persistence.txt\ncat $LINUX_ROOT\u002Fetc\u002Fcrontab >> \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flinux_persistence.txt 2>\u002Fdev\u002Fnull\nls -la $LINUX_ROOT\u002Fetc\u002Fcron.d\u002F >> \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flinux_persistence.txt 2>\u002Fdev\u002Fnull\ncat $LINUX_ROOT\u002Fetc\u002Fcron.d\u002F* >> \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flinux_persistence.txt 2>\u002Fdev\u002Fnull\ncat $LINUX_ROOT\u002Fvar\u002Fspool\u002Fcron\u002Fcrontabs\u002F* >> \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flinux_persistence.txt 2>\u002Fdev\u002Fnull\n\n# Systemd services\necho \"--- Custom Systemd Services ---\" >> \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flinux_persistence.txt\nfind $LINUX_ROOT\u002Fetc\u002Fsystemd\u002Fsystem\u002F -name \"*.service\" -not -type l \\\n   >> \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flinux_persistence.txt 2>\u002Fdev\u002Fnull\n\n# SSH authorized keys\necho \"--- SSH Authorized Keys ---\" >> \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flinux_persistence.txt\nfind $LINUX_ROOT\u002Fhome\u002F $LINUX_ROOT\u002Froot\u002F -name \"authorized_keys\" -exec cat {} \\; \\\n   >> \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flinux_persistence.txt 2>\u002Fdev\u002Fnull\n\n# Init scripts and rc.local\necho \"--- RC Scripts ---\" >> \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flinux_persistence.txt\ncat $LINUX_ROOT\u002Fetc\u002Frc.local >> \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flinux_persistence.txt 2>\u002Fdev\u002Fnull\n\n# Shell profile scripts\necho \"--- Profile Scripts ---\" >> \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flinux_persistence.txt\ncat $LINUX_ROOT\u002Fetc\u002Fprofile.d\u002F*.sh >> \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flinux_persistence.txt 2>\u002Fdev\u002Fnull\n\n# LD_PRELOAD\necho \"--- LD_PRELOAD ---\" >> \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flinux_persistence.txt\ncat $LINUX_ROOT\u002Fetc\u002Fld.so.preload >> \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flinux_persistence.txt 2>\u002Fdev\u002Fnull\ngrep -r \"LD_PRELOAD\" $LINUX_ROOT\u002Fetc\u002F >> \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flinux_persistence.txt 2>\u002Fdev\u002Fnull\n\n# Kernel modules\necho \"--- Loaded Kernel Modules ---\" >> \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flinux_persistence.txt\ncat $LINUX_ROOT\u002Fetc\u002Fmodules-load.d\u002F*.conf >> \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flinux_persistence.txt 2>\u002Fdev\u002Fnull\n\n# PAM backdoors\necho \"--- PAM Configuration ---\" >> \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flinux_persistence.txt\nfind $LINUX_ROOT\u002Fetc\u002Fpam.d\u002F -exec grep -l \"pam_exec\\|pam_script\" {} \\; \\\n   >> \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flinux_persistence.txt 2>\u002Fdev\u002Fnull\n```\n\n### Step 5: Compile Persistence Report\n\n```bash\n# Generate comprehensive persistence report\npython3 \u003C\u003C 'PYEOF'\nimport json\n\nwith open('\u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fregistry_persistence.json') as f:\n    reg_data = json.load(f)\n\nreport = \"\"\"\nMALWARE PERSISTENCE INVESTIGATION REPORT\n==========================================\n\nPERSISTENCE MECHANISMS FOUND:\n\n1. REGISTRY RUN KEYS:\n\"\"\"\n\nrun_keys = [e for e in reg_data['registry_persistence'] if 'Run' in e.get('type', '')]\nfor entry in run_keys:\n    report += f\"   [{entry['timestamp']}] {entry.get('name', 'N\u002FA')} -> {entry.get('value', '')[:100]}\\n\"\n\nservices = [e for e in reg_data['registry_persistence'] if e.get('type') == 'Service']\nreport += f\"\\n2. SERVICES ({len(services)} auto-start services):\\n\"\nfor entry in services[:20]:\n    report += f\"   {entry['location'].split('\\\\')[-1]}: {entry['value'][:100]}\\n\"\n\nreport += \"\"\"\n3. SCHEDULED TASKS: [See scheduled_tasks analysis]\n4. WMI SUBSCRIPTIONS: [See WMI analysis]\n5. STARTUP FOLDER: [See startup_items.txt]\n6. COM HIJACKING: [See COM analysis]\n\nSUSPICIOUS ENTRIES REQUIRING INVESTIGATION:\n\"\"\"\n\n# Flag suspicious entries\nfor entry in reg_data['registry_persistence']:\n    value = str(entry.get('value', '')).lower()\n    suspicious_indicators = ['powershell', 'cmd \u002Fc', 'wscript', 'certutil',\n                             'programdata', 'appdata\\\\local\\\\temp', 'base64',\n                             '.ps1', '.vbs', '.hta', '\u002Ftmp\u002F', 'hidden']\n    if any(s in value for s in suspicious_indicators):\n        report += f\"   SUSPICIOUS: {entry.get('name', 'N\u002FA')} -> {entry.get('value', '')[:100]}\\n\"\n\nwith open('\u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fpersistence_report.txt', 'w') as f:\n    f.write(report)\n\nprint(report)\nPYEOF\n```\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| Run keys | Registry keys executing programs at user logon (HKLM and HKCU) |\n| Scheduled tasks | Windows Task Scheduler entries that execute on triggers (time, event, logon) |\n| WMI event subscriptions | Persistent WMI queries that trigger actions (stealthy persistence) |\n| COM hijacking | Redirecting COM object loading to execute malicious DLLs |\n| DLL search order hijacking | Placing malicious DLLs in directories searched before System32 |\n| Service persistence | Installing Windows services that auto-start with the system |\n| Boot-level persistence | Modifying boot configuration or MBR\u002FVBR for pre-OS execution |\n| Living-off-the-land | Using legitimate system tools (PowerShell, WMI, certutil) for persistence |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| Autoruns | Sysinternals comprehensive autostart enumeration tool |\n| RegRipper | Automated registry persistence artifact extraction |\n| KAPE | Automated persistence artifact collection and analysis |\n| Velociraptor | Endpoint agent with persistence hunting artifacts |\n| OSQuery | SQL-based system querying for persistence enumeration |\n| PersistenceSniper | PowerShell tool for Windows persistence detection |\n| RECmd | Eric Zimmerman registry command-line analysis tool |\n| Volatility | Memory forensics for in-memory only persistence |\n\n## Common Scenarios\n\n**Scenario 1: APT Persistence After Initial Compromise**\nCheck all registry Run keys, enumerate scheduled tasks for encoded PowerShell commands, examine WMI event subscriptions for event-triggered execution, check COM object registrations for hijacked CLSIDs, review services for recently installed entries with suspicious image paths.\n\n**Scenario 2: Ransomware Pre-Encryption Persistence**\nIdentify how the ransomware maintains access for re-encryption or monitoring, check for scheduled tasks that would re-launch encryption, examine services installed by the ransomware operator, verify no additional backdoor persistence exists before declaring remediation complete.\n\n**Scenario 3: Fileless Malware Persistence**\nFocus on registry-based persistence storing payload in registry values, check WMI subscriptions executing PowerShell from event triggers, examine scheduled tasks using encoded command arguments, check for mshta\u002Frundll32 based persistence loading remote content.\n\n**Scenario 4: Post-Remediation Verification**\nRun Autoruns comparison against known-good baseline, verify all identified persistence mechanisms have been removed, check for additional persistence that may have been missed, confirm services, tasks, and registry entries are clean, monitor for re-infection indicators.\n\n## Output Format\n\n```\nPersistence Investigation Summary:\n  System: DESKTOP-ABC123 (Windows 10 Pro)\n  Analysis Date: 2024-01-20\n\n  Persistence Mechanisms Found:\n    Registry Run Keys (HKLM):    5 entries (1 SUSPICIOUS)\n    Registry Run Keys (HKCU):    3 entries (1 SUSPICIOUS)\n    Services (Auto-Start):       142 entries (2 SUSPICIOUS)\n    Scheduled Tasks:             67 entries (3 SUSPICIOUS)\n    WMI Subscriptions:           1 entry (SUSPICIOUS)\n    Startup Folder:              4 items (1 SUSPICIOUS)\n    COM Objects:                 0 hijacked entries\n    DLL Hijacking:               0 detected\n\n  Suspicious Entries:\n    1. HKCU\\Run\\WindowsUpdate -> powershell -ep bypass -e \u003Cbase64>\n       Timestamp: 2024-01-15 14:35:00\n       Action: Encoded PowerShell download cradle\n\n    2. Service: WinDefenderUpdate -> C:\\ProgramData\\svc\\update.exe\n       Timestamp: 2024-01-15 14:40:00\n       Action: Unknown executable in ProgramData\n\n    3. Task: \\Microsoft\\Windows\\Maintenance\\SecurityUpdate\n       Command: cmd.exe \u002Fc powershell -w hidden -e \u003Cbase64>\n       Trigger: On system startup\n\n    4. WMI: __EventFilter \"ProcessStart\" -> CommandLineEventConsumer\n       Action: Execute C:\\Windows\\Temp\\svc.exe on WMI event\n\n  Remediation Required: 4 persistence mechanisms to remove\n  Report: \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fpersistence_report.txt\n```\n","# Performing Malware Persistence Investigation\n\n## When to Use\n- When investigating how malware maintains presence on a compromised system after reboots\n- During incident response to identify all persistence mechanisms for complete remediation\n- For threat hunting to discover unauthorized autostart entries across endpoints\n- When analyzing malware behavior to understand its persistence strategy\n- For verifying that all persistence has been removed after incident remediation\n\n## Prerequisites\n- Forensic image or live system access with administrative privileges\n- Autoruns (Sysinternals) for Windows persistence enumeration\n- RegRipper for offline registry analysis\n- Understanding of Windows and Linux persistence mechanisms\n- YARA rules for scanning persistence locations\n- Baseline of known-good autorun entries for comparison\n\n## Workflow\n\n### Step 1: Enumerate Windows Registry Persistence\n\n```bash\n# Extract registry hives from forensic image\nmount -o ro,loop,offset=$((2048*512)) \u002Fcases\u002Fcase-2024-001\u002Fimages\u002Fevidence.dd \u002Fmnt\u002Fevidence\n\n# Key registry persistence locations\npython3 \u003C\u003C 'PYEOF'\nfrom Registry import Registry\nimport json\n\nresults = {'registry_persistence': []}\n\n# SYSTEM hive analysis\nsystem_reg = Registry.Registry(\"\u002Fcases\u002Fcase-2024-001\u002Fregistry\u002FSYSTEM\")\nselect = system_reg.open(\"Select\")\ncurrent = select.value(\"Current\").value()\ncs = f\"ControlSet{current:03d}\"\n\n# Services (very common persistence)\nservices = system_reg.open(f\"{cs}\\\\Services\")\nfor svc in services.subkeys():\n    try:\n        start_type = svc.value(\"Start\").value()\n        image_path = \"\"\n        try:\n            image_path = svc.value(\"ImagePath\").value()\n        except:\n            pass\n        # Start types: 0=Boot, 1=System, 2=Auto, 3=Manual, 4=Disabled\n        if start_type in (0, 1, 2) and image_path:\n            svc_type = svc.value(\"Type\").value() if svc.values() else 0\n            results['registry_persistence'].append({\n                'location': f'HKLM\\\\SYSTEM\\\\{cs}\\\\Services\\\\{svc.name()}',\n                'type': 'Service',\n                'value': image_path,\n                'start_type': start_type,\n                'timestamp': str(svc.timestamp())\n            })\n    except Exception:\n        pass\n\n# SOFTWARE hive analysis\nsw_reg = Registry.Registry(\"\u002Fcases\u002Fcase-2024-001\u002Fregistry\u002FSOFTWARE\")\n\n# Machine Run keys\nrun_keys = [\n    \"Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\",\n    \"Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce\",\n    \"Microsoft\\\\Windows\\\\CurrentVersion\\\\RunServices\",\n    \"Microsoft\\\\Windows\\\\CurrentVersion\\\\RunServicesOnce\",\n    \"Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\Explorer\\\\Run\",\n    \"Wow6432Node\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\",\n    \"Wow6432Node\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce\",\n]\n\nfor key_path in run_keys:\n    try:\n        key = sw_reg.open(key_path)\n        for value in key.values():\n            results['registry_persistence'].append({\n                'location': f'HKLM\\\\SOFTWARE\\\\{key_path}',\n                'type': 'Run Key',\n                'name': value.name(),\n                'value': str(value.value()),\n                'timestamp': str(key.timestamp())\n            })\n    except Exception:\n        pass\n\n# NTUSER.DAT analysis\nimport glob\nfor ntuser in glob.glob(\"\u002Fcases\u002Fcase-2024-001\u002Fregistry\u002FNTUSER*.DAT\"):\n    try:\n        user_reg = Registry.Registry(ntuser)\n        user_run_keys = [\n            \"Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\",\n            \"Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce\",\n            \"Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Explorer\\\\Shell Folders\\\\Startup\",\n        ]\n        for key_path in user_run_keys:\n            try:\n                key = user_reg.open(key_path)\n                for value in key.values():\n                    results['registry_persistence'].append({\n                        'location': f'HKCU\\\\{key_path}',\n                        'type': 'User Run Key',\n                        'name': value.name(),\n                        'value': str(value.value()),\n                        'timestamp': str(key.timestamp()),\n                        'hive': ntuser\n                    })\n            except Exception:\n                pass\n    except Exception:\n        pass\n\nprint(f\"Total registry persistence entries: {len(results['registry_persistence'])}\")\nfor entry in results['registry_persistence']:\n    print(f\"  [{entry['type']}] {entry.get('name', '')} -> {entry.get('value', '')[:100]}\")\n\nwith open('\u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fregistry_persistence.json', 'w') as f:\n    json.dump(results, f, indent=2)\nPYEOF\n```\n\n### Step 2: Check Scheduled Tasks and WMI Persistence\n\n```bash\n# Extract scheduled tasks from forensic image\nmkdir -p \u002Fcases\u002Fcase-2024-001\u002Fpersistence\u002Ftasks\u002F\ncp -r \u002Fmnt\u002Fevidence\u002FWindows\u002FSystem32\u002FTasks\u002F* \u002Fcases\u002Fcase-2024-001\u002Fpersistence\u002Ftasks\u002F 2>\u002Fdev\u002Fnull\n\n# Parse scheduled task XML files\npython3 \u003C\u003C 'PYEOF'\nimport os, xml.etree.ElementTree as ET\n\ntasks_dir = '\u002Fcases\u002Fcase-2024-001\u002Fpersistence\u002Ftasks\u002F'\nsuspicious_tasks = []\n\nfor root_dir, dirs, files in os.walk(tasks_dir):\n    for fname in files:\n        fpath = os.path.join(root_dir, fname)\n        try:\n            tree = ET.parse(fpath)\n            root = tree.getroot()\n            ns = {'t': 'http:\u002F\u002Fschemas.microsoft.com\u002Fwindows\u002F2004\u002F02\u002Fmit\u002Ftask'}\n\n            actions = root.findall('.\u002F\u002Ft:Exec', ns)\n            for action in actions:\n                command = action.find('t:Command', ns)\n                args = action.find('t:Arguments', ns)\n                cmd_text = command.text if command is not None else ''\n                args_text = args.text if args is not None else ''\n\n                # Flag suspicious commands\n                suspicious_indicators = [\n                    'powershell', 'cmd.exe', 'wscript', 'cscript', 'mshta',\n                    'regsvr32', 'rundll32', 'certutil', 'bitsadmin',\n                    '\u002Fc ', '-enc', '-e ', 'hidden', 'bypass', 'downloadstring',\n                    'invoke-', 'iex', '\u002Ftmp\u002F', 'appdata', 'programdata',\n                    'temp\\\\', '.ps1', '.vbs', '.hta', 'base64'\n                ]\n\n                is_suspicious = any(s in (cmd_text + ' ' + args_text).lower() for s in suspicious_indicators)\n\n                task_info = {\n                    'name': fname,\n                    'path': fpath.replace(tasks_dir, ''),\n                    'command': cmd_text,\n                    'arguments': args_text,\n                    'suspicious': is_suspicious\n                }\n\n                if is_suspicious:\n                    suspicious_tasks.append(task_info)\n                    print(f\"SUSPICIOUS TASK: {fname}\")\n                    print(f\"  Command: {cmd_text}\")\n                    print(f\"  Arguments: {args_text}\")\n                    print()\n\n        except Exception as e:\n            pass\n\nprint(f\"\\nTotal suspicious scheduled tasks: {len(suspicious_tasks)}\")\nPYEOF\n\n# Check WMI event subscriptions (common APT persistence)\n# WMI repository: C:\\Windows\\System32\\wbem\\Repository\\\ncp -r \u002Fmnt\u002Fevidence\u002FWindows\u002FSystem32\u002Fwbem\u002FRepository\u002F \u002Fcases\u002Fcase-2024-001\u002Fpersistence\u002Fwmi\u002F 2>\u002Fdev\u002Fnull\n\n# Parse WMI persistence using PyWMIPersistenceFinder\npython3 \u003C\u003C 'PYEOF'\nimport os, re\n\n# Search WMI OBJECTS.DATA for event subscriptions\nwmi_db = '\u002Fcases\u002Fcase-2024-001\u002Fpersistence\u002Fwmi\u002FOBJECTS.DATA'\nif os.path.exists(wmi_db):\n    with open(wmi_db, 'rb') as f:\n        data = f.read()\n\n    # Search for EventFilter strings\n    filters = re.findall(b'__EventFilter.*?(?=\\x00\\x00)', data)\n    consumers = re.findall(b'CommandLineEventConsumer.*?(?=\\x00\\x00)', data)\n    bindings = re.findall(b'__FilterToConsumerBinding.*?(?=\\x00\\x00)', data)\n\n    print(\"=== WMI PERSISTENCE ===\")\n    print(f\"Event Filters: {len(filters)}\")\n    print(f\"Command Consumers: {len(consumers)}\")\n    print(f\"Filter-Consumer Bindings: {len(bindings)}\")\n\n    for consumer in consumers:\n        decoded = consumer.decode('utf-8', errors='ignore')\n        print(f\"  Consumer: {decoded[:200]}\")\nelse:\n    print(\"WMI repository not found\")\nPYEOF\n```\n\n### Step 3: Check File System and Boot Persistence\n\n```bash\n# Startup folders\necho \"=== STARTUP FOLDER CONTENTS ===\" > \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fstartup_items.txt\n\nls -la \"\u002Fmnt\u002Fevidence\u002FProgramData\u002FMicrosoft\u002FWindows\u002FStart Menu\u002FPrograms\u002FStartup\u002F\" \\\n   >> \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fstartup_items.txt 2>\u002Fdev\u002Fnull\n\nfor userdir in \u002Fmnt\u002Fevidence\u002FUsers\u002F*\u002F; do\n    username=$(basename \"$userdir\")\n    echo \"--- User: $username ---\" >> \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fstartup_items.txt\n    ls -la \"$userdir\u002FAppData\u002FRoaming\u002FMicrosoft\u002FWindows\u002FStart Menu\u002FPrograms\u002FStartup\u002F\" \\\n       >> \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fstartup_items.txt 2>\u002Fdev\u002Fnull\ndone\n\n# Check DLL search order hijacking locations\necho \"=== DLL HIJACKING CHECK ===\" > \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fdll_hijack.txt\n# Check for DLLs in application directories that should only be in System32\nfind \u002Fmnt\u002Fevidence\u002FProgram\\ Files\u002F \u002Fmnt\u002Fevidence\u002FProgram\\ Files\\ \\(x86\\)\u002F \\\n   -name \"*.dll\" -newer \u002Fmnt\u002Fevidence\u002FWindows\u002FSystem32\u002Fntdll.dll 2>\u002Fdev\u002Fnull \\\n   >> \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fdll_hijack.txt\n\n# Check for COM object hijacking\npython3 \u003C\u003C 'PYEOF'\nfrom Registry import Registry\n\nreg = Registry.Registry(\"\u002Fcases\u002Fcase-2024-001\u002Fregistry\u002FSOFTWARE\")\n\n# Check for suspicious CLSID entries\ntry:\n    clsid = reg.open(\"Classes\\\\CLSID\")\n    for key in clsid.subkeys():\n        try:\n            server = key.subkey(\"InprocServer32\")\n            dll_path = server.value(\"(default)\").value()\n            if any(s in dll_path.lower() for s in ['temp', 'appdata', 'programdata', 'downloads', 'tmp']):\n                print(f\"SUSPICIOUS COM: {key.name()} -> {dll_path}\")\n        except:\n            pass\nexcept:\n    pass\nPYEOF\n\n# Check boot configuration for bootkits\n# BCD (Boot Configuration Data)\nls -la \u002Fmnt\u002Fevidence\u002FBoot\u002FBCD 2>\u002Fdev\u002Fnull\n# Check for modified bootmgr or winload.exe\nsha256sum \u002Fmnt\u002Fevidence\u002FWindows\u002FSystem32\u002Fwinload.exe 2>\u002Fdev\u002Fnull\n```\n\n### Step 4: Check Linux Persistence Mechanisms\n\n```bash\n# If analyzing a Linux system\nLINUX_ROOT=\"\u002Fmnt\u002Fevidence\"\n\necho \"=== LINUX PERSISTENCE CHECK ===\" > \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flinux_persistence.txt\n\n# Cron jobs\necho \"--- Cron Jobs ---\" >> \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flinux_persistence.txt\ncat $LINUX_ROOT\u002Fetc\u002Fcrontab >> \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flinux_persistence.txt 2>\u002Fdev\u002Fnull\nls -la $LINUX_ROOT\u002Fetc\u002Fcron.d\u002F >> \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flinux_persistence.txt 2>\u002Fdev\u002Fnull\ncat $LINUX_ROOT\u002Fetc\u002Fcron.d\u002F* >> \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flinux_persistence.txt 2>\u002Fdev\u002Fnull\ncat $LINUX_ROOT\u002Fvar\u002Fspool\u002Fcron\u002Fcrontabs\u002F* >> \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flinux_persistence.txt 2>\u002Fdev\u002Fnull\n\n# Systemd services\necho \"--- Custom Systemd Services ---\" >> \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flinux_persistence.txt\nfind $LINUX_ROOT\u002Fetc\u002Fsystemd\u002Fsystem\u002F -name \"*.service\" -not -type l \\\n   >> \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flinux_persistence.txt 2>\u002Fdev\u002Fnull\n\n# SSH authorized keys\necho \"--- SSH Authorized Keys ---\" >> \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flinux_persistence.txt\nfind $LINUX_ROOT\u002Fhome\u002F $LINUX_ROOT\u002Froot\u002F -name \"authorized_keys\" -exec cat {} \\; \\\n   >> \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flinux_persistence.txt 2>\u002Fdev\u002Fnull\n\n# Init scripts and rc.local\necho \"--- RC Scripts ---\" >> \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flinux_persistence.txt\ncat $LINUX_ROOT\u002Fetc\u002Frc.local >> \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flinux_persistence.txt 2>\u002Fdev\u002Fnull\n\n# Shell profile scripts\necho \"--- Profile Scripts ---\" >> \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flinux_persistence.txt\ncat $LINUX_ROOT\u002Fetc\u002Fprofile.d\u002F*.sh >> \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flinux_persistence.txt 2>\u002Fdev\u002Fnull\n\n# LD_PRELOAD\necho \"--- LD_PRELOAD ---\" >> \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flinux_persistence.txt\ncat $LINUX_ROOT\u002Fetc\u002Fld.so.preload >> \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flinux_persistence.txt 2>\u002Fdev\u002Fnull\ngrep -r \"LD_PRELOAD\" $LINUX_ROOT\u002Fetc\u002F >> \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flinux_persistence.txt 2>\u002Fdev\u002Fnull\n\n# Kernel modules\necho \"--- Loaded Kernel Modules ---\" >> \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flinux_persistence.txt\ncat $LINUX_ROOT\u002Fetc\u002Fmodules-load.d\u002F*.conf >> \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flinux_persistence.txt 2>\u002Fdev\u002Fnull\n\n# PAM backdoors\necho \"--- PAM Configuration ---\" >> \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flinux_persistence.txt\nfind $LINUX_ROOT\u002Fetc\u002Fpam.d\u002F -exec grep -l \"pam_exec\\|pam_script\" {} \\; \\\n   >> \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flinux_persistence.txt 2>\u002Fdev\u002Fnull\n```\n\n### Step 5: Compile Persistence Report\n\n```bash\n# Generate comprehensive persistence report\npython3 \u003C\u003C 'PYEOF'\nimport json\n\nwith open('\u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fregistry_persistence.json') as f:\n    reg_data = json.load(f)\n\nreport = \"\"\"\nMALWARE PERSISTENCE INVESTIGATION REPORT\n==========================================\n\nPERSISTENCE MECHANISMS FOUND:\n\n1. REGISTRY RUN KEYS:\n\"\"\"\n\nrun_keys = [e for e in reg_data['registry_persistence'] if 'Run' in e.get('type', '')]\nfor entry in run_keys:\n    report += f\"   [{entry['timestamp']}] {entry.get('name', 'N\u002FA')} -> {entry.get('value', '')[:100]}\\n\"\n\nservices = [e for e in reg_data['registry_persistence'] if e.get('type') == 'Service']\nreport += f\"\\n2. SERVICES ({len(services)} auto-start services):\\n\"\nfor entry in services[:20]:\n    report += f\"   {entry['location'].split('\\\\')[-1]}: {entry['value'][:100]}\\n\"\n\nreport += \"\"\"\n3. SCHEDULED TASKS: [See scheduled_tasks analysis]\n4. WMI SUBSCRIPTIONS: [See WMI analysis]\n5. STARTUP FOLDER: [See startup_items.txt]\n6. COM HIJACKING: [See COM analysis]\n\nSUSPICIOUS ENTRIES REQUIRING INVESTIGATION:\n\"\"\"\n\n# Flag suspicious entries\nfor entry in reg_data['registry_persistence']:\n    value = str(entry.get('value', '')).lower()\n    suspicious_indicators = ['powershell', 'cmd \u002Fc', 'wscript', 'certutil',\n                             'programdata', 'appdata\\\\local\\\\temp', 'base64',\n                             '.ps1', '.vbs', '.hta', '\u002Ftmp\u002F', 'hidden']\n    if any(s in value for s in suspicious_indicators):\n        report += f\"   SUSPICIOUS: {entry.get('name', 'N\u002FA')} -> {entry.get('value', '')[:100]}\\n\"\n\nwith open('\u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fpersistence_report.txt', 'w') as f:\n    f.write(report)\n\nprint(report)\nPYEOF\n```\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| Run keys | Registry keys executing programs at user logon (HKLM and HKCU) |\n| Scheduled tasks | Windows Task Scheduler entries that execute on triggers (time, event, logon) |\n| WMI event subscriptions | Persistent WMI queries that trigger actions (stealthy persistence) |\n| COM hijacking | Redirecting COM object loading to execute malicious DLLs |\n| DLL search order hijacking | Placing malicious DLLs in directories searched before System32 |\n| Service persistence | Installing Windows services that auto-start with the system |\n| Boot-level persistence | Modifying boot configuration or MBR\u002FVBR for pre-OS execution |\n| Living-off-the-land | Using legitimate system tools (PowerShell, WMI, certutil) for persistence |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| Autoruns | Sysinternals comprehensive autostart enumeration tool |\n| RegRipper | Automated registry persistence artifact extraction |\n| KAPE | Automated persistence artifact collection and analysis |\n| Velociraptor | Endpoint agent with persistence hunting artifacts |\n| OSQuery | SQL-based system querying for persistence enumeration |\n| PersistenceSniper | PowerShell tool for Windows persistence detection |\n| RECmd | Eric Zimmerman registry command-line analysis tool |\n| Volatility | Memory forensics for in-memory only persistence |\n\n## Common Scenarios\n\n**Scenario 1: APT Persistence After Initial Compromise**\nCheck all registry Run keys, enumerate scheduled tasks for encoded PowerShell commands, examine WMI event subscriptions for event-triggered execution, check COM object registrations for hijacked CLSIDs, review services for recently installed entries with suspicious image paths.\n\n**Scenario 2: Ransomware Pre-Encryption Persistence**\nIdentify how the ransomware maintains access for re-encryption or monitoring, check for scheduled tasks that would re-launch encryption, examine services installed by the ransomware operator, verify no additional backdoor persistence exists before declaring remediation complete.\n\n**Scenario 3: Fileless Malware Persistence**\nFocus on registry-based persistence storing payload in registry values, check WMI subscriptions executing PowerShell from event triggers, examine scheduled tasks using encoded command arguments, check for mshta\u002Frundll32 based persistence loading remote content.\n\n**Scenario 4: Post-Remediation Verification**\nRun Autoruns comparison against known-good baseline, verify all identified persistence mechanisms have been removed, check for additional persistence that may have been missed, confirm services, tasks, and registry entries are clean, monitor for re-infection indicators.\n\n## Output Format\n\n```\nPersistence Investigation Summary:\n  System: DESKTOP-ABC123 (Windows 10 Pro)\n  Analysis Date: 2024-01-20\n\n  Persistence Mechanisms Found:\n    Registry Run Keys (HKLM):    5 entries (1 SUSPICIOUS)\n    Registry Run Keys (HKCU):    3 entries (1 SUSPICIOUS)\n    Services (Auto-Start):       142 entries (2 SUSPICIOUS)\n    Scheduled Tasks:             67 entries (3 SUSPICIOUS)\n    WMI Subscriptions:           1 entry (SUSPICIOUS)\n    Startup Folder:              4 items (1 SUSPICIOUS)\n    COM Objects:                 0 hijacked entries\n    DLL Hijacking:               0 detected\n\n  Suspicious Entries:\n    1. HKCU\\Run\\WindowsUpdate -> powershell -ep bypass -e \u003Cbase64>\n       Timestamp: 2024-01-15 14:35:00\n       Action: Encoded PowerShell download cradle\n\n    2. Service: WinDefenderUpdate -> C:\\ProgramData\\svc\\update.exe\n       Timestamp: 2024-01-15 14:40:00\n       Action: Unknown executable in ProgramData\n\n    3. Task: \\Microsoft\\Windows\\Maintenance\\SecurityUpdate\n       Command: cmd.exe \u002Fc powershell -w hidden -e \u003Cbase64>\n       Trigger: On system startup\n\n    4. WMI: __EventFilter \"ProcessStart\" -> CommandLineEventConsumer\n       Action: Execute C:\\Windows\\Temp\\svc.exe on WMI event\n\n  Remediation Required: 4 persistence mechanisms to remove\n  Report: \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fpersistence_report.txt\n```\n",{"name":5,"tags":44,"capec":50,"model":51,"tools":52,"domain":36,"maxTurns":56,"nist_csf":57,"subdomain":23,"description":7,"mitre_attack":62},[45,46,47,27,25,48,49],"forensics","malware-persistence","autoruns","rootkit-detection","incident-response",[],"sonnet",[53,32,54,55],"Read","Glob","Grep",20,[58,59,60,61],"RS.AN-01","RS.AN-03","DE.AE-02","RS.MA-01",[38,63,33,64,65,66,67,68],"T1053.005","T1546.003","T1574","T1014","T1059","T1547","main","a91f1293287ffa9f4f1b8f486cd6e835a1568c84","skills\u002Fmalware\u002Fanalysis\u002Fforensic\u002Fcollect","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace","https:\u002F\u002Fgithub.com\u002FDCx7C5","#Python","2026-09-01 11:21:00",{"source":8,"skillName":5,"commands":77,"prompt":87,"zipAvailable":88},[78,81,84],{"tool":79,"command":80},"npx","npx skills add DCx7C5\u002Fai-marketplace --skill analysis-forensic-collect",{"tool":82,"command":83},"bunx","bunx skills add DCx7C5\u002Fai-marketplace --skill analysis-forensic-collect",{"tool":85,"command":86},"pnpm","pnpm dlx skills add DCx7C5\u002Fai-marketplace --skill analysis-forensic-collect","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fmalware\u002Fanalysis\u002Fforensic\u002Fcollect\u002FSKILL.md",true,[90],{"path":91,"resourceType":92,"resourceTypeDesc":93,"sizeBytes":94,"sourceHtmlUrl":95},"index.json","REFERENCE","参考文档",635,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fmalware\u002Fanalysis\u002Fforensic\u002Fcollect\u002Findex.json",[97,120,140,159,181,197],{"skillNo":98,"name":99,"nameZh":6,"description":100,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":101,"categories":102,"keywords":103,"publishedAt":39},"01M71HAPZ01KQ30RKTB0FFSQ05","services-wmi-persistence-detect","Detect WMI event subscription persistence by enumerating ActiveScriptEventConsumer, CommandLineEventConsumer, and permanent subscriptions in the WMI repository.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fpersistence\u002Fdetect\u002FSKILL.md",[],[104,105,106,107,108,30,109,110,111,112,113,114,115,116,117,118,45,36,119],"services","detect","services wmi persistence detect","wmi","persistence","cm","process","activescript","event","subscriptions","commandline-consumer","repository","subscription","event-subscription","t1546.003","process-forensics",{"skillNo":121,"name":122,"nameZh":6,"description":123,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":124,"categories":125,"keywords":126,"publishedAt":39},"01M71HAK6JTTTS229T17WJMMCG","services-wmi-exec-exploit","Perform lateral movement across Windows networks using WMI-based remote execution techniques including Impacket wmiexec.py, CrackMapExec, and native WMI commands for stealthy post-exploitation during red team engagements.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fexec\u002Fexploit\u002FSKILL.md",[],[127,104,128,107,129,130,131,36,32,22,132,133,134,135,30,136,137,28,138,139],"exploit","services wmi exec exploit","exec","remote","traffic","team","across","crackmapexec","native","command","lateral movement","lateral-movement","Impacket",{"skillNo":141,"name":142,"nameZh":6,"description":143,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":144,"categories":145,"keywords":146,"publishedAt":39},"01M71HAG6MHKNQV8KDZKMT4886","registry-artifact-extract","Extract and analyze Windows Registry hives to uncover user activity, installed software, autostart entries, and evidence of system compromise.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fregistry\u002Fartifact\u002Fextract\u002FSKILL.md",[],[147,27,148,149,150,151,36,32,152,22,153,154,30,28,155,156,23,157,158,51],"artifact","registry artifact extract","extract","evidence-collection","artifact-analysis","collection","analyze","uncover","software","activity","windows-registry","regripper",{"skillNo":160,"name":161,"nameZh":6,"description":162,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":163,"categories":164,"keywords":165,"publishedAt":39},"01M71HACR4A8XTWTTSXK4124AA","processes-token-impersonate-detect","Detect Windows token impersonation and privilege abuse including SeImpersonatePrivilege exploitation via Potato attacks and token stealing techniques.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Ftoken\u002Fimpersonate\u002Fdetect\u002FSKILL.md",[],[105,166,167,168,169,170,171,109,172,36,119,173,174,175,176,177,178,179,180,30],"processes token impersonate detect","token","processes","attacks","windows","escalation","techniques","privilege-escalation","seimpersonate","token-impersonation","printspoofer","exploitation","potato","impersonation","via",{"skillNo":182,"name":183,"nameZh":6,"description":184,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":185,"categories":186,"keywords":187,"publishedAt":39},"01M71HAABSB4Z6QFSXEG00R4RK","processes-thread-injection-detect","Detect Windows thread injection techniques including CreateRemoteThread, QueueUserAPC, NtCreateThreadEx, and thread hijacking via process memory analysis.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fthread\u002Finjection\u002Fdetect\u002FSKILL.md",[],[188,189,105,190,168,170,191,109,192,172,36,119,22,193,194,195,196,180,30,110],"thread","processes thread injection detect","injection","memory","process-injection","api","apc-injection","thread-injection","nt-api",{"skillNo":198,"name":199,"nameZh":6,"description":200,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":201,"categories":202,"keywords":203,"publishedAt":39},"01M71HA7H311V5G14WMX58HQSS","processes-hollow-technique-detect","Detect process hollowing (RunPE) by identifying processes with mismatched image paths between PEB and VAD tree, or unmapped PE headers in memory.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fhollow\u002Ftechnique\u002Fdetect\u002FSKILL.md",[],[204,105,168,205,191,109,206,207,36,119,208,209,210,211,212,213,30,110,214,215],"processes hollow technique detect","tree","memory-forensics","process-hollow","peb","runpe","image","pe-header","in memory","with","mismatched","headers"]