[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M78TTCRWCDYYAJSYC37AW9HD":3,"skill-same:01M78TTCRWCDYYAJSYC37AW9HD":76},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":16,"sourceHtmlUrl":17,"categories":18,"keywords":19,"publishedAt":20,"linkOnly":21,"markdownContent":22,"markdownBody":23,"frontMatter":24,"refName":37,"commitSha":38,"skillDirectory":39,"forksCount":40,"repositoryHtmlUrl":41,"repositoryHomepageUrl":6,"ownerHtmlUrl":42,"ownerBlogUrl":43,"ownerDescription":44,"updatedAt":45,"install":46,"resources":59},"01M78TTCRWCDYYAJSYC37AW9HD","performing-malware-persistence-investigation",null,"Systematically investigate all persistence mechanisms on Windows and Linux systems to identify how malware survives reboots and maintains access.","jukeyman\u002Fjukeyman-skills","jukeyman","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F142960420?v=4","01M78FR4Y3DHMMCBCC0GXXNB3F","RICK JEFFERSON","01M78FR4Z8RVQRAD31Y5J7V6EB",1,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fjukeyman\u002Fjukeyman-skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-malware-persistence-investigation\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fjukeyman\u002Fjukeyman-skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-malware-persistence-investigation\u002FSKILL.md",[],[],"2026-11-15 14:19:17",false,"---\nname: performing-malware-persistence-investigation\ndescription: Systematically investigate all persistence mechanisms on Windows and Linux systems to identify how malware survives reboots and maintains access.\ndomain: cybersecurity\nsubdomain: digital-forensics\ntags: [forensics, malware-persistence, autoruns, registry, scheduled-tasks, rootkit-detection, incident-response]\nversion: \"1.0\"\nauthor: mahipal\nlicense: Apache-2.0\n---\n\n# Performing Malware Persistence Investigation\n\n## When to Use\n- When investigating how malware maintains presence on a compromised system after reboots\n- During incident response to identify all persistence mechanisms for complete remediation\n- For threat hunting to discover unauthorized autostart entries across endpoints\n- When analyzing malware behavior to understand its persistence strategy\n- For verifying that all persistence has been removed after incident remediation\n\n## Prerequisites\n- Forensic image or live system access with administrative privileges\n- Autoruns (Sysinternals) for Windows persistence enumeration\n- RegRipper for offline registry analysis\n- Understanding of Windows and Linux persistence mechanisms\n- YARA rules for scanning persistence locations\n- Baseline of known-good autorun entries for comparison\n\n## Workflow\n\n### Step 1: Enumerate Windows Registry Persistence\n\n```bash\n# Extract registry hives from forensic image\nmount -o ro,loop,offset=$((2048*512)) \u002Fcases\u002Fcase-2024-001\u002Fimages\u002Fevidence.dd \u002Fmnt\u002Fevidence\n\n# Key registry persistence locations\npython3 \u003C\u003C 'PYEOF'\nfrom Registry import Registry\nimport json\n\nresults = {'registry_persistence': []}\n\n# SYSTEM hive analysis\nsystem_reg = Registry.Registry(\"\u002Fcases\u002Fcase-2024-001\u002Fregistry\u002FSYSTEM\")\nselect = system_reg.open(\"Select\")\ncurrent = select.value(\"Current\").value()\ncs = f\"ControlSet{current:03d}\"\n\n# Services (very common persistence)\nservices = system_reg.open(f\"{cs}\\\\Services\")\nfor svc in services.subkeys():\n    try:\n        start_type = svc.value(\"Start\").value()\n        image_path = \"\"\n        try:\n            image_path = svc.value(\"ImagePath\").value()\n        except:\n            pass\n        # Start types: 0=Boot, 1=System, 2=Auto, 3=Manual, 4=Disabled\n        if start_type in (0, 1, 2) and image_path:\n            svc_type = svc.value(\"Type\").value() if svc.values() else 0\n            results['registry_persistence'].append({\n                'location': f'HKLM\\\\SYSTEM\\\\{cs}\\\\Services\\\\{svc.name()}',\n                'type': 'Service',\n                'value': image_path,\n                'start_type': start_type,\n                'timestamp': str(svc.timestamp())\n            })\n    except Exception:\n        pass\n\n# SOFTWARE hive analysis\nsw_reg = Registry.Registry(\"\u002Fcases\u002Fcase-2024-001\u002Fregistry\u002FSOFTWARE\")\n\n# Machine Run keys\nrun_keys = [\n    \"Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\",\n    \"Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce\",\n    \"Microsoft\\\\Windows\\\\CurrentVersion\\\\RunServices\",\n    \"Microsoft\\\\Windows\\\\CurrentVersion\\\\RunServicesOnce\",\n    \"Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\Explorer\\\\Run\",\n    \"Wow6432Node\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\",\n    \"Wow6432Node\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce\",\n]\n\nfor key_path in run_keys:\n    try:\n        key = sw_reg.open(key_path)\n        for value in key.values():\n            results['registry_persistence'].append({\n                'location': f'HKLM\\\\SOFTWARE\\\\{key_path}',\n                'type': 'Run Key',\n                'name': value.name(),\n                'value': str(value.value()),\n                'timestamp': str(key.timestamp())\n            })\n    except Exception:\n        pass\n\n# NTUSER.DAT analysis\nimport glob\nfor ntuser in glob.glob(\"\u002Fcases\u002Fcase-2024-001\u002Fregistry\u002FNTUSER*.DAT\"):\n    try:\n        user_reg = Registry.Registry(ntuser)\n        user_run_keys = [\n            \"Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\",\n            \"Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce\",\n            \"Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Explorer\\\\Shell Folders\\\\Startup\",\n        ]\n        for key_path in user_run_keys:\n            try:\n                key = user_reg.open(key_path)\n                for value in key.values():\n                    results['registry_persistence'].append({\n                        'location': f'HKCU\\\\{key_path}',\n                        'type': 'User Run Key',\n                        'name': value.name(),\n                        'value': str(value.value()),\n                        'timestamp': str(key.timestamp()),\n                        'hive': ntuser\n                    })\n            except Exception:\n                pass\n    except Exception:\n        pass\n\nprint(f\"Total registry persistence entries: {len(results['registry_persistence'])}\")\nfor entry in results['registry_persistence']:\n    print(f\"  [{entry['type']}] {entry.get('name', '')} -> {entry.get('value', '')[:100]}\")\n\nwith open('\u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fregistry_persistence.json', 'w') as f:\n    json.dump(results, f, indent=2)\nPYEOF\n```\n\n### Step 2: Check Scheduled Tasks and WMI Persistence\n\n```bash\n# Extract scheduled tasks from forensic image\nmkdir -p \u002Fcases\u002Fcase-2024-001\u002Fpersistence\u002Ftasks\u002F\ncp -r \u002Fmnt\u002Fevidence\u002FWindows\u002FSystem32\u002FTasks\u002F* \u002Fcases\u002Fcase-2024-001\u002Fpersistence\u002Ftasks\u002F 2>\u002Fdev\u002Fnull\n\n# Parse scheduled task XML files\npython3 \u003C\u003C 'PYEOF'\nimport os, xml.etree.ElementTree as ET\n\ntasks_dir = '\u002Fcases\u002Fcase-2024-001\u002Fpersistence\u002Ftasks\u002F'\nsuspicious_tasks = []\n\nfor root_dir, dirs, files in os.walk(tasks_dir):\n    for fname in files:\n        fpath = os.path.join(root_dir, fname)\n        try:\n            tree = ET.parse(fpath)\n            root = tree.getroot()\n            ns = {'t': 'http:\u002F\u002Fschemas.microsoft.com\u002Fwindows\u002F2004\u002F02\u002Fmit\u002Ftask'}\n\n            actions = root.findall('.\u002F\u002Ft:Exec', ns)\n            for action in actions:\n                command = action.find('t:Command', ns)\n                args = action.find('t:Arguments', ns)\n                cmd_text = command.text if command is not None else ''\n                args_text = args.text if args is not None else ''\n\n                # Flag suspicious commands\n                suspicious_indicators = [\n                    'powershell', 'cmd.exe', 'wscript', 'cscript', 'mshta',\n                    'regsvr32', 'rundll32', 'certutil', 'bitsadmin',\n                    '\u002Fc ', '-enc', '-e ', 'hidden', 'bypass', 'downloadstring',\n                    'invoke-', 'iex', '\u002Ftmp\u002F', 'appdata', 'programdata',\n                    'temp\\\\', '.ps1', '.vbs', '.hta', 'base64'\n                ]\n\n                is_suspicious = any(s in (cmd_text + ' ' + args_text).lower() for s in suspicious_indicators)\n\n                task_info = {\n                    'name': fname,\n                    'path': fpath.replace(tasks_dir, ''),\n                    'command': cmd_text,\n                    'arguments': args_text,\n                    'suspicious': is_suspicious\n                }\n\n                if is_suspicious:\n                    suspicious_tasks.append(task_info)\n                    print(f\"SUSPICIOUS TASK: {fname}\")\n                    print(f\"  Command: {cmd_text}\")\n                    print(f\"  Arguments: {args_text}\")\n                    print()\n\n        except Exception as e:\n            pass\n\nprint(f\"\\nTotal suspicious scheduled tasks: {len(suspicious_tasks)}\")\nPYEOF\n\n# Check WMI event subscriptions (common APT persistence)\n# WMI repository: C:\\Windows\\System32\\wbem\\Repository\\\ncp -r \u002Fmnt\u002Fevidence\u002FWindows\u002FSystem32\u002Fwbem\u002FRepository\u002F \u002Fcases\u002Fcase-2024-001\u002Fpersistence\u002Fwmi\u002F 2>\u002Fdev\u002Fnull\n\n# Parse WMI persistence using PyWMIPersistenceFinder\npython3 \u003C\u003C 'PYEOF'\nimport os, re\n\n# Search WMI OBJECTS.DATA for event subscriptions\nwmi_db = '\u002Fcases\u002Fcase-2024-001\u002Fpersistence\u002Fwmi\u002FOBJECTS.DATA'\nif os.path.exists(wmi_db):\n    with open(wmi_db, 'rb') as f:\n        data = f.read()\n\n    # Search for EventFilter strings\n    filters = re.findall(b'__EventFilter.*?(?=\\x00\\x00)', data)\n    consumers = re.findall(b'CommandLineEventConsumer.*?(?=\\x00\\x00)', data)\n    bindings = re.findall(b'__FilterToConsumerBinding.*?(?=\\x00\\x00)', data)\n\n    print(\"=== WMI PERSISTENCE ===\")\n    print(f\"Event Filters: {len(filters)}\")\n    print(f\"Command Consumers: {len(consumers)}\")\n    print(f\"Filter-Consumer Bindings: {len(bindings)}\")\n\n    for consumer in consumers:\n        decoded = consumer.decode('utf-8', errors='ignore')\n        print(f\"  Consumer: {decoded[:200]}\")\nelse:\n    print(\"WMI repository not found\")\nPYEOF\n```\n\n### Step 3: Check File System and Boot Persistence\n\n```bash\n# Startup folders\necho \"=== STARTUP FOLDER CONTENTS ===\" > \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fstartup_items.txt\n\nls -la \"\u002Fmnt\u002Fevidence\u002FProgramData\u002FMicrosoft\u002FWindows\u002FStart Menu\u002FPrograms\u002FStartup\u002F\" \\\n   >> \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fstartup_items.txt 2>\u002Fdev\u002Fnull\n\nfor userdir in \u002Fmnt\u002Fevidence\u002FUsers\u002F*\u002F; do\n    username=$(basename \"$userdir\")\n    echo \"--- User: $username ---\" >> \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fstartup_items.txt\n    ls -la \"$userdir\u002FAppData\u002FRoaming\u002FMicrosoft\u002FWindows\u002FStart Menu\u002FPrograms\u002FStartup\u002F\" \\\n       >> \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fstartup_items.txt 2>\u002Fdev\u002Fnull\ndone\n\n# Check DLL search order hijacking locations\necho \"=== DLL HIJACKING CHECK ===\" > \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fdll_hijack.txt\n# Check for DLLs in application directories that should only be in System32\nfind \u002Fmnt\u002Fevidence\u002FProgram\\ Files\u002F \u002Fmnt\u002Fevidence\u002FProgram\\ Files\\ \\(x86\\)\u002F \\\n   -name \"*.dll\" -newer \u002Fmnt\u002Fevidence\u002FWindows\u002FSystem32\u002Fntdll.dll 2>\u002Fdev\u002Fnull \\\n   >> \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fdll_hijack.txt\n\n# Check for COM object hijacking\npython3 \u003C\u003C 'PYEOF'\nfrom Registry import Registry\n\nreg = Registry.Registry(\"\u002Fcases\u002Fcase-2024-001\u002Fregistry\u002FSOFTWARE\")\n\n# Check for suspicious CLSID entries\ntry:\n    clsid = reg.open(\"Classes\\\\CLSID\")\n    for key in clsid.subkeys():\n        try:\n            server = key.subkey(\"InprocServer32\")\n            dll_path = server.value(\"(default)\").value()\n            if any(s in dll_path.lower() for s in ['temp', 'appdata', 'programdata', 'downloads', 'tmp']):\n                print(f\"SUSPICIOUS COM: {key.name()} -> {dll_path}\")\n        except:\n            pass\nexcept:\n    pass\nPYEOF\n\n# Check boot configuration for bootkits\n# BCD (Boot Configuration Data)\nls -la \u002Fmnt\u002Fevidence\u002FBoot\u002FBCD 2>\u002Fdev\u002Fnull\n# Check for modified bootmgr or winload.exe\nsha256sum \u002Fmnt\u002Fevidence\u002FWindows\u002FSystem32\u002Fwinload.exe 2>\u002Fdev\u002Fnull\n```\n\n### Step 4: Check Linux Persistence Mechanisms\n\n```bash\n# If analyzing a Linux system\nLINUX_ROOT=\"\u002Fmnt\u002Fevidence\"\n\necho \"=== LINUX PERSISTENCE CHECK ===\" > \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flinux_persistence.txt\n\n# Cron jobs\necho \"--- Cron Jobs ---\" >> \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flinux_persistence.txt\ncat $LINUX_ROOT\u002Fetc\u002Fcrontab >> \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flinux_persistence.txt 2>\u002Fdev\u002Fnull\nls -la $LINUX_ROOT\u002Fetc\u002Fcron.d\u002F >> \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flinux_persistence.txt 2>\u002Fdev\u002Fnull\ncat $LINUX_ROOT\u002Fetc\u002Fcron.d\u002F* >> \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flinux_persistence.txt 2>\u002Fdev\u002Fnull\ncat $LINUX_ROOT\u002Fvar\u002Fspool\u002Fcron\u002Fcrontabs\u002F* >> \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flinux_persistence.txt 2>\u002Fdev\u002Fnull\n\n# Systemd services\necho \"--- Custom Systemd Services ---\" >> \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flinux_persistence.txt\nfind $LINUX_ROOT\u002Fetc\u002Fsystemd\u002Fsystem\u002F -name \"*.service\" -not -type l \\\n   >> \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flinux_persistence.txt 2>\u002Fdev\u002Fnull\n\n# SSH authorized keys\necho \"--- SSH Authorized Keys ---\" >> \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flinux_persistence.txt\nfind $LINUX_ROOT\u002Fhome\u002F $LINUX_ROOT\u002Froot\u002F -name \"authorized_keys\" -exec cat {} \\; \\\n   >> \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flinux_persistence.txt 2>\u002Fdev\u002Fnull\n\n# Init scripts and rc.local\necho \"--- RC Scripts ---\" >> \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flinux_persistence.txt\ncat $LINUX_ROOT\u002Fetc\u002Frc.local >> \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flinux_persistence.txt 2>\u002Fdev\u002Fnull\n\n# Shell profile scripts\necho \"--- Profile Scripts ---\" >> \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flinux_persistence.txt\ncat $LINUX_ROOT\u002Fetc\u002Fprofile.d\u002F*.sh >> \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flinux_persistence.txt 2>\u002Fdev\u002Fnull\n\n# LD_PRELOAD\necho \"--- LD_PRELOAD ---\" >> \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flinux_persistence.txt\ncat $LINUX_ROOT\u002Fetc\u002Fld.so.preload >> \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flinux_persistence.txt 2>\u002Fdev\u002Fnull\ngrep -r \"LD_PRELOAD\" $LINUX_ROOT\u002Fetc\u002F >> \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flinux_persistence.txt 2>\u002Fdev\u002Fnull\n\n# Kernel modules\necho \"--- Loaded Kernel Modules ---\" >> \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flinux_persistence.txt\ncat $LINUX_ROOT\u002Fetc\u002Fmodules-load.d\u002F*.conf >> \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flinux_persistence.txt 2>\u002Fdev\u002Fnull\n\n# PAM backdoors\necho \"--- PAM Configuration ---\" >> \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flinux_persistence.txt\nfind $LINUX_ROOT\u002Fetc\u002Fpam.d\u002F -exec grep -l \"pam_exec\\|pam_script\" {} \\; \\\n   >> \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flinux_persistence.txt 2>\u002Fdev\u002Fnull\n```\n\n### Step 5: Compile Persistence Report\n\n```bash\n# Generate comprehensive persistence report\npython3 \u003C\u003C 'PYEOF'\nimport json\n\nwith open('\u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fregistry_persistence.json') as f:\n    reg_data = json.load(f)\n\nreport = \"\"\"\nMALWARE PERSISTENCE INVESTIGATION REPORT\n==========================================\n\nPERSISTENCE MECHANISMS FOUND:\n\n1. REGISTRY RUN KEYS:\n\"\"\"\n\nrun_keys = [e for e in reg_data['registry_persistence'] if 'Run' in e.get('type', '')]\nfor entry in run_keys:\n    report += f\"   [{entry['timestamp']}] {entry.get('name', 'N\u002FA')} -> {entry.get('value', '')[:100]}\\n\"\n\nservices = [e for e in reg_data['registry_persistence'] if e.get('type') == 'Service']\nreport += f\"\\n2. SERVICES ({len(services)} auto-start services):\\n\"\nfor entry in services[:20]:\n    report += f\"   {entry['location'].split('\\\\')[-1]}: {entry['value'][:100]}\\n\"\n\nreport += \"\"\"\n3. SCHEDULED TASKS: [See scheduled_tasks analysis]\n4. WMI SUBSCRIPTIONS: [See WMI analysis]\n5. STARTUP FOLDER: [See startup_items.txt]\n6. COM HIJACKING: [See COM analysis]\n\nSUSPICIOUS ENTRIES REQUIRING INVESTIGATION:\n\"\"\"\n\n# Flag suspicious entries\nfor entry in reg_data['registry_persistence']:\n    value = str(entry.get('value', '')).lower()\n    suspicious_indicators = ['powershell', 'cmd \u002Fc', 'wscript', 'certutil',\n                             'programdata', 'appdata\\\\local\\\\temp', 'base64',\n                             '.ps1', '.vbs', '.hta', '\u002Ftmp\u002F', 'hidden']\n    if any(s in value for s in suspicious_indicators):\n        report += f\"   SUSPICIOUS: {entry.get('name', 'N\u002FA')} -> {entry.get('value', '')[:100]}\\n\"\n\nwith open('\u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fpersistence_report.txt', 'w') as f:\n    f.write(report)\n\nprint(report)\nPYEOF\n```\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| Run keys | Registry keys executing programs at user logon (HKLM and HKCU) |\n| Scheduled tasks | Windows Task Scheduler entries that execute on triggers (time, event, logon) |\n| WMI event subscriptions | Persistent WMI queries that trigger actions (stealthy persistence) |\n| COM hijacking | Redirecting COM object loading to execute malicious DLLs |\n| DLL search order hijacking | Placing malicious DLLs in directories searched before System32 |\n| Service persistence | Installing Windows services that auto-start with the system |\n| Boot-level persistence | Modifying boot configuration or MBR\u002FVBR for pre-OS execution |\n| Living-off-the-land | Using legitimate system tools (PowerShell, WMI, certutil) for persistence |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| Autoruns | Sysinternals comprehensive autostart enumeration tool |\n| RegRipper | Automated registry persistence artifact extraction |\n| KAPE | Automated persistence artifact collection and analysis |\n| Velociraptor | Endpoint agent with persistence hunting artifacts |\n| OSQuery | SQL-based system querying for persistence enumeration |\n| PersistenceSniper | PowerShell tool for Windows persistence detection |\n| RECmd | Eric Zimmerman registry command-line analysis tool |\n| Volatility | Memory forensics for in-memory only persistence |\n\n## Common Scenarios\n\n**Scenario 1: APT Persistence After Initial Compromise**\nCheck all registry Run keys, enumerate scheduled tasks for encoded PowerShell commands, examine WMI event subscriptions for event-triggered execution, check COM object registrations for hijacked CLSIDs, review services for recently installed entries with suspicious image paths.\n\n**Scenario 2: Ransomware Pre-Encryption Persistence**\nIdentify how the ransomware maintains access for re-encryption or monitoring, check for scheduled tasks that would re-launch encryption, examine services installed by the ransomware operator, verify no additional backdoor persistence exists before declaring remediation complete.\n\n**Scenario 3: Fileless Malware Persistence**\nFocus on registry-based persistence storing payload in registry values, check WMI subscriptions executing PowerShell from event triggers, examine scheduled tasks using encoded command arguments, check for mshta\u002Frundll32 based persistence loading remote content.\n\n**Scenario 4: Post-Remediation Verification**\nRun Autoruns comparison against known-good baseline, verify all identified persistence mechanisms have been removed, check for additional persistence that may have been missed, confirm services, tasks, and registry entries are clean, monitor for re-infection indicators.\n\n## Output Format\n\n```\nPersistence Investigation Summary:\n  System: DESKTOP-ABC123 (Windows 10 Pro)\n  Analysis Date: 2024-01-20\n\n  Persistence Mechanisms Found:\n    Registry Run Keys (HKLM):    5 entries (1 SUSPICIOUS)\n    Registry Run Keys (HKCU):    3 entries (1 SUSPICIOUS)\n    Services (Auto-Start):       142 entries (2 SUSPICIOUS)\n    Scheduled Tasks:             67 entries (3 SUSPICIOUS)\n    WMI Subscriptions:           1 entry (SUSPICIOUS)\n    Startup Folder:              4 items (1 SUSPICIOUS)\n    COM Objects:                 0 hijacked entries\n    DLL Hijacking:               0 detected\n\n  Suspicious Entries:\n    1. HKCU\\Run\\WindowsUpdate -> powershell -ep bypass -e \u003Cbase64>\n       Timestamp: 2024-01-15 14:35:00\n       Action: Encoded PowerShell download cradle\n\n    2. Service: WinDefenderUpdate -> C:\\ProgramData\\svc\\update.exe\n       Timestamp: 2024-01-15 14:40:00\n       Action: Unknown executable in ProgramData\n\n    3. Task: \\Microsoft\\Windows\\Maintenance\\SecurityUpdate\n       Command: cmd.exe \u002Fc powershell -w hidden -e \u003Cbase64>\n       Trigger: On system startup\n\n    4. WMI: __EventFilter \"ProcessStart\" -> CommandLineEventConsumer\n       Action: Execute C:\\Windows\\Temp\\svc.exe on WMI event\n\n  Remediation Required: 4 persistence mechanisms to remove\n  Report: \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fpersistence_report.txt\n```\n","# Performing Malware Persistence Investigation\n\n## When to Use\n- When investigating how malware maintains presence on a compromised system after reboots\n- During incident response to identify all persistence mechanisms for complete remediation\n- For threat hunting to discover unauthorized autostart entries across endpoints\n- When analyzing malware behavior to understand its persistence strategy\n- For verifying that all persistence has been removed after incident remediation\n\n## Prerequisites\n- Forensic image or live system access with administrative privileges\n- Autoruns (Sysinternals) for Windows persistence enumeration\n- RegRipper for offline registry analysis\n- Understanding of Windows and Linux persistence mechanisms\n- YARA rules for scanning persistence locations\n- Baseline of known-good autorun entries for comparison\n\n## Workflow\n\n### Step 1: Enumerate Windows Registry Persistence\n\n```bash\n# Extract registry hives from forensic image\nmount -o ro,loop,offset=$((2048*512)) \u002Fcases\u002Fcase-2024-001\u002Fimages\u002Fevidence.dd \u002Fmnt\u002Fevidence\n\n# Key registry persistence locations\npython3 \u003C\u003C 'PYEOF'\nfrom Registry import Registry\nimport json\n\nresults = {'registry_persistence': []}\n\n# SYSTEM hive analysis\nsystem_reg = Registry.Registry(\"\u002Fcases\u002Fcase-2024-001\u002Fregistry\u002FSYSTEM\")\nselect = system_reg.open(\"Select\")\ncurrent = select.value(\"Current\").value()\ncs = f\"ControlSet{current:03d}\"\n\n# Services (very common persistence)\nservices = system_reg.open(f\"{cs}\\\\Services\")\nfor svc in services.subkeys():\n    try:\n        start_type = svc.value(\"Start\").value()\n        image_path = \"\"\n        try:\n            image_path = svc.value(\"ImagePath\").value()\n        except:\n            pass\n        # Start types: 0=Boot, 1=System, 2=Auto, 3=Manual, 4=Disabled\n        if start_type in (0, 1, 2) and image_path:\n            svc_type = svc.value(\"Type\").value() if svc.values() else 0\n            results['registry_persistence'].append({\n                'location': f'HKLM\\\\SYSTEM\\\\{cs}\\\\Services\\\\{svc.name()}',\n                'type': 'Service',\n                'value': image_path,\n                'start_type': start_type,\n                'timestamp': str(svc.timestamp())\n            })\n    except Exception:\n        pass\n\n# SOFTWARE hive analysis\nsw_reg = Registry.Registry(\"\u002Fcases\u002Fcase-2024-001\u002Fregistry\u002FSOFTWARE\")\n\n# Machine Run keys\nrun_keys = [\n    \"Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\",\n    \"Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce\",\n    \"Microsoft\\\\Windows\\\\CurrentVersion\\\\RunServices\",\n    \"Microsoft\\\\Windows\\\\CurrentVersion\\\\RunServicesOnce\",\n    \"Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\Explorer\\\\Run\",\n    \"Wow6432Node\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\",\n    \"Wow6432Node\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce\",\n]\n\nfor key_path in run_keys:\n    try:\n        key = sw_reg.open(key_path)\n        for value in key.values():\n            results['registry_persistence'].append({\n                'location': f'HKLM\\\\SOFTWARE\\\\{key_path}',\n                'type': 'Run Key',\n                'name': value.name(),\n                'value': str(value.value()),\n                'timestamp': str(key.timestamp())\n            })\n    except Exception:\n        pass\n\n# NTUSER.DAT analysis\nimport glob\nfor ntuser in glob.glob(\"\u002Fcases\u002Fcase-2024-001\u002Fregistry\u002FNTUSER*.DAT\"):\n    try:\n        user_reg = Registry.Registry(ntuser)\n        user_run_keys = [\n            \"Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\",\n            \"Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce\",\n            \"Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Explorer\\\\Shell Folders\\\\Startup\",\n        ]\n        for key_path in user_run_keys:\n            try:\n                key = user_reg.open(key_path)\n                for value in key.values():\n                    results['registry_persistence'].append({\n                        'location': f'HKCU\\\\{key_path}',\n                        'type': 'User Run Key',\n                        'name': value.name(),\n                        'value': str(value.value()),\n                        'timestamp': str(key.timestamp()),\n                        'hive': ntuser\n                    })\n            except Exception:\n                pass\n    except Exception:\n        pass\n\nprint(f\"Total registry persistence entries: {len(results['registry_persistence'])}\")\nfor entry in results['registry_persistence']:\n    print(f\"  [{entry['type']}] {entry.get('name', '')} -> {entry.get('value', '')[:100]}\")\n\nwith open('\u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fregistry_persistence.json', 'w') as f:\n    json.dump(results, f, indent=2)\nPYEOF\n```\n\n### Step 2: Check Scheduled Tasks and WMI Persistence\n\n```bash\n# Extract scheduled tasks from forensic image\nmkdir -p \u002Fcases\u002Fcase-2024-001\u002Fpersistence\u002Ftasks\u002F\ncp -r \u002Fmnt\u002Fevidence\u002FWindows\u002FSystem32\u002FTasks\u002F* \u002Fcases\u002Fcase-2024-001\u002Fpersistence\u002Ftasks\u002F 2>\u002Fdev\u002Fnull\n\n# Parse scheduled task XML files\npython3 \u003C\u003C 'PYEOF'\nimport os, xml.etree.ElementTree as ET\n\ntasks_dir = '\u002Fcases\u002Fcase-2024-001\u002Fpersistence\u002Ftasks\u002F'\nsuspicious_tasks = []\n\nfor root_dir, dirs, files in os.walk(tasks_dir):\n    for fname in files:\n        fpath = os.path.join(root_dir, fname)\n        try:\n            tree = ET.parse(fpath)\n            root = tree.getroot()\n            ns = {'t': 'http:\u002F\u002Fschemas.microsoft.com\u002Fwindows\u002F2004\u002F02\u002Fmit\u002Ftask'}\n\n            actions = root.findall('.\u002F\u002Ft:Exec', ns)\n            for action in actions:\n                command = action.find('t:Command', ns)\n                args = action.find('t:Arguments', ns)\n                cmd_text = command.text if command is not None else ''\n                args_text = args.text if args is not None else ''\n\n                # Flag suspicious commands\n                suspicious_indicators = [\n                    'powershell', 'cmd.exe', 'wscript', 'cscript', 'mshta',\n                    'regsvr32', 'rundll32', 'certutil', 'bitsadmin',\n                    '\u002Fc ', '-enc', '-e ', 'hidden', 'bypass', 'downloadstring',\n                    'invoke-', 'iex', '\u002Ftmp\u002F', 'appdata', 'programdata',\n                    'temp\\\\', '.ps1', '.vbs', '.hta', 'base64'\n                ]\n\n                is_suspicious = any(s in (cmd_text + ' ' + args_text).lower() for s in suspicious_indicators)\n\n                task_info = {\n                    'name': fname,\n                    'path': fpath.replace(tasks_dir, ''),\n                    'command': cmd_text,\n                    'arguments': args_text,\n                    'suspicious': is_suspicious\n                }\n\n                if is_suspicious:\n                    suspicious_tasks.append(task_info)\n                    print(f\"SUSPICIOUS TASK: {fname}\")\n                    print(f\"  Command: {cmd_text}\")\n                    print(f\"  Arguments: {args_text}\")\n                    print()\n\n        except Exception as e:\n            pass\n\nprint(f\"\\nTotal suspicious scheduled tasks: {len(suspicious_tasks)}\")\nPYEOF\n\n# Check WMI event subscriptions (common APT persistence)\n# WMI repository: C:\\Windows\\System32\\wbem\\Repository\\\ncp -r \u002Fmnt\u002Fevidence\u002FWindows\u002FSystem32\u002Fwbem\u002FRepository\u002F \u002Fcases\u002Fcase-2024-001\u002Fpersistence\u002Fwmi\u002F 2>\u002Fdev\u002Fnull\n\n# Parse WMI persistence using PyWMIPersistenceFinder\npython3 \u003C\u003C 'PYEOF'\nimport os, re\n\n# Search WMI OBJECTS.DATA for event subscriptions\nwmi_db = '\u002Fcases\u002Fcase-2024-001\u002Fpersistence\u002Fwmi\u002FOBJECTS.DATA'\nif os.path.exists(wmi_db):\n    with open(wmi_db, 'rb') as f:\n        data = f.read()\n\n    # Search for EventFilter strings\n    filters = re.findall(b'__EventFilter.*?(?=\\x00\\x00)', data)\n    consumers = re.findall(b'CommandLineEventConsumer.*?(?=\\x00\\x00)', data)\n    bindings = re.findall(b'__FilterToConsumerBinding.*?(?=\\x00\\x00)', data)\n\n    print(\"=== WMI PERSISTENCE ===\")\n    print(f\"Event Filters: {len(filters)}\")\n    print(f\"Command Consumers: {len(consumers)}\")\n    print(f\"Filter-Consumer Bindings: {len(bindings)}\")\n\n    for consumer in consumers:\n        decoded = consumer.decode('utf-8', errors='ignore')\n        print(f\"  Consumer: {decoded[:200]}\")\nelse:\n    print(\"WMI repository not found\")\nPYEOF\n```\n\n### Step 3: Check File System and Boot Persistence\n\n```bash\n# Startup folders\necho \"=== STARTUP FOLDER CONTENTS ===\" > \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fstartup_items.txt\n\nls -la \"\u002Fmnt\u002Fevidence\u002FProgramData\u002FMicrosoft\u002FWindows\u002FStart Menu\u002FPrograms\u002FStartup\u002F\" \\\n   >> \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fstartup_items.txt 2>\u002Fdev\u002Fnull\n\nfor userdir in \u002Fmnt\u002Fevidence\u002FUsers\u002F*\u002F; do\n    username=$(basename \"$userdir\")\n    echo \"--- User: $username ---\" >> \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fstartup_items.txt\n    ls -la \"$userdir\u002FAppData\u002FRoaming\u002FMicrosoft\u002FWindows\u002FStart Menu\u002FPrograms\u002FStartup\u002F\" \\\n       >> \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fstartup_items.txt 2>\u002Fdev\u002Fnull\ndone\n\n# Check DLL search order hijacking locations\necho \"=== DLL HIJACKING CHECK ===\" > \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fdll_hijack.txt\n# Check for DLLs in application directories that should only be in System32\nfind \u002Fmnt\u002Fevidence\u002FProgram\\ Files\u002F \u002Fmnt\u002Fevidence\u002FProgram\\ Files\\ \\(x86\\)\u002F \\\n   -name \"*.dll\" -newer \u002Fmnt\u002Fevidence\u002FWindows\u002FSystem32\u002Fntdll.dll 2>\u002Fdev\u002Fnull \\\n   >> \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fdll_hijack.txt\n\n# Check for COM object hijacking\npython3 \u003C\u003C 'PYEOF'\nfrom Registry import Registry\n\nreg = Registry.Registry(\"\u002Fcases\u002Fcase-2024-001\u002Fregistry\u002FSOFTWARE\")\n\n# Check for suspicious CLSID entries\ntry:\n    clsid = reg.open(\"Classes\\\\CLSID\")\n    for key in clsid.subkeys():\n        try:\n            server = key.subkey(\"InprocServer32\")\n            dll_path = server.value(\"(default)\").value()\n            if any(s in dll_path.lower() for s in ['temp', 'appdata', 'programdata', 'downloads', 'tmp']):\n                print(f\"SUSPICIOUS COM: {key.name()} -> {dll_path}\")\n        except:\n            pass\nexcept:\n    pass\nPYEOF\n\n# Check boot configuration for bootkits\n# BCD (Boot Configuration Data)\nls -la \u002Fmnt\u002Fevidence\u002FBoot\u002FBCD 2>\u002Fdev\u002Fnull\n# Check for modified bootmgr or winload.exe\nsha256sum \u002Fmnt\u002Fevidence\u002FWindows\u002FSystem32\u002Fwinload.exe 2>\u002Fdev\u002Fnull\n```\n\n### Step 4: Check Linux Persistence Mechanisms\n\n```bash\n# If analyzing a Linux system\nLINUX_ROOT=\"\u002Fmnt\u002Fevidence\"\n\necho \"=== LINUX PERSISTENCE CHECK ===\" > \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flinux_persistence.txt\n\n# Cron jobs\necho \"--- Cron Jobs ---\" >> \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flinux_persistence.txt\ncat $LINUX_ROOT\u002Fetc\u002Fcrontab >> \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flinux_persistence.txt 2>\u002Fdev\u002Fnull\nls -la $LINUX_ROOT\u002Fetc\u002Fcron.d\u002F >> \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flinux_persistence.txt 2>\u002Fdev\u002Fnull\ncat $LINUX_ROOT\u002Fetc\u002Fcron.d\u002F* >> \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flinux_persistence.txt 2>\u002Fdev\u002Fnull\ncat $LINUX_ROOT\u002Fvar\u002Fspool\u002Fcron\u002Fcrontabs\u002F* >> \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flinux_persistence.txt 2>\u002Fdev\u002Fnull\n\n# Systemd services\necho \"--- Custom Systemd Services ---\" >> \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flinux_persistence.txt\nfind $LINUX_ROOT\u002Fetc\u002Fsystemd\u002Fsystem\u002F -name \"*.service\" -not -type l \\\n   >> \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flinux_persistence.txt 2>\u002Fdev\u002Fnull\n\n# SSH authorized keys\necho \"--- SSH Authorized Keys ---\" >> \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flinux_persistence.txt\nfind $LINUX_ROOT\u002Fhome\u002F $LINUX_ROOT\u002Froot\u002F -name \"authorized_keys\" -exec cat {} \\; \\\n   >> \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flinux_persistence.txt 2>\u002Fdev\u002Fnull\n\n# Init scripts and rc.local\necho \"--- RC Scripts ---\" >> \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flinux_persistence.txt\ncat $LINUX_ROOT\u002Fetc\u002Frc.local >> \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flinux_persistence.txt 2>\u002Fdev\u002Fnull\n\n# Shell profile scripts\necho \"--- Profile Scripts ---\" >> \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flinux_persistence.txt\ncat $LINUX_ROOT\u002Fetc\u002Fprofile.d\u002F*.sh >> \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flinux_persistence.txt 2>\u002Fdev\u002Fnull\n\n# LD_PRELOAD\necho \"--- LD_PRELOAD ---\" >> \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flinux_persistence.txt\ncat $LINUX_ROOT\u002Fetc\u002Fld.so.preload >> \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flinux_persistence.txt 2>\u002Fdev\u002Fnull\ngrep -r \"LD_PRELOAD\" $LINUX_ROOT\u002Fetc\u002F >> \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flinux_persistence.txt 2>\u002Fdev\u002Fnull\n\n# Kernel modules\necho \"--- Loaded Kernel Modules ---\" >> \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flinux_persistence.txt\ncat $LINUX_ROOT\u002Fetc\u002Fmodules-load.d\u002F*.conf >> \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flinux_persistence.txt 2>\u002Fdev\u002Fnull\n\n# PAM backdoors\necho \"--- PAM Configuration ---\" >> \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flinux_persistence.txt\nfind $LINUX_ROOT\u002Fetc\u002Fpam.d\u002F -exec grep -l \"pam_exec\\|pam_script\" {} \\; \\\n   >> \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flinux_persistence.txt 2>\u002Fdev\u002Fnull\n```\n\n### Step 5: Compile Persistence Report\n\n```bash\n# Generate comprehensive persistence report\npython3 \u003C\u003C 'PYEOF'\nimport json\n\nwith open('\u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fregistry_persistence.json') as f:\n    reg_data = json.load(f)\n\nreport = \"\"\"\nMALWARE PERSISTENCE INVESTIGATION REPORT\n==========================================\n\nPERSISTENCE MECHANISMS FOUND:\n\n1. REGISTRY RUN KEYS:\n\"\"\"\n\nrun_keys = [e for e in reg_data['registry_persistence'] if 'Run' in e.get('type', '')]\nfor entry in run_keys:\n    report += f\"   [{entry['timestamp']}] {entry.get('name', 'N\u002FA')} -> {entry.get('value', '')[:100]}\\n\"\n\nservices = [e for e in reg_data['registry_persistence'] if e.get('type') == 'Service']\nreport += f\"\\n2. SERVICES ({len(services)} auto-start services):\\n\"\nfor entry in services[:20]:\n    report += f\"   {entry['location'].split('\\\\')[-1]}: {entry['value'][:100]}\\n\"\n\nreport += \"\"\"\n3. SCHEDULED TASKS: [See scheduled_tasks analysis]\n4. WMI SUBSCRIPTIONS: [See WMI analysis]\n5. STARTUP FOLDER: [See startup_items.txt]\n6. COM HIJACKING: [See COM analysis]\n\nSUSPICIOUS ENTRIES REQUIRING INVESTIGATION:\n\"\"\"\n\n# Flag suspicious entries\nfor entry in reg_data['registry_persistence']:\n    value = str(entry.get('value', '')).lower()\n    suspicious_indicators = ['powershell', 'cmd \u002Fc', 'wscript', 'certutil',\n                             'programdata', 'appdata\\\\local\\\\temp', 'base64',\n                             '.ps1', '.vbs', '.hta', '\u002Ftmp\u002F', 'hidden']\n    if any(s in value for s in suspicious_indicators):\n        report += f\"   SUSPICIOUS: {entry.get('name', 'N\u002FA')} -> {entry.get('value', '')[:100]}\\n\"\n\nwith open('\u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fpersistence_report.txt', 'w') as f:\n    f.write(report)\n\nprint(report)\nPYEOF\n```\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| Run keys | Registry keys executing programs at user logon (HKLM and HKCU) |\n| Scheduled tasks | Windows Task Scheduler entries that execute on triggers (time, event, logon) |\n| WMI event subscriptions | Persistent WMI queries that trigger actions (stealthy persistence) |\n| COM hijacking | Redirecting COM object loading to execute malicious DLLs |\n| DLL search order hijacking | Placing malicious DLLs in directories searched before System32 |\n| Service persistence | Installing Windows services that auto-start with the system |\n| Boot-level persistence | Modifying boot configuration or MBR\u002FVBR for pre-OS execution |\n| Living-off-the-land | Using legitimate system tools (PowerShell, WMI, certutil) for persistence |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| Autoruns | Sysinternals comprehensive autostart enumeration tool |\n| RegRipper | Automated registry persistence artifact extraction |\n| KAPE | Automated persistence artifact collection and analysis |\n| Velociraptor | Endpoint agent with persistence hunting artifacts |\n| OSQuery | SQL-based system querying for persistence enumeration |\n| PersistenceSniper | PowerShell tool for Windows persistence detection |\n| RECmd | Eric Zimmerman registry command-line analysis tool |\n| Volatility | Memory forensics for in-memory only persistence |\n\n## Common Scenarios\n\n**Scenario 1: APT Persistence After Initial Compromise**\nCheck all registry Run keys, enumerate scheduled tasks for encoded PowerShell commands, examine WMI event subscriptions for event-triggered execution, check COM object registrations for hijacked CLSIDs, review services for recently installed entries with suspicious image paths.\n\n**Scenario 2: Ransomware Pre-Encryption Persistence**\nIdentify how the ransomware maintains access for re-encryption or monitoring, check for scheduled tasks that would re-launch encryption, examine services installed by the ransomware operator, verify no additional backdoor persistence exists before declaring remediation complete.\n\n**Scenario 3: Fileless Malware Persistence**\nFocus on registry-based persistence storing payload in registry values, check WMI subscriptions executing PowerShell from event triggers, examine scheduled tasks using encoded command arguments, check for mshta\u002Frundll32 based persistence loading remote content.\n\n**Scenario 4: Post-Remediation Verification**\nRun Autoruns comparison against known-good baseline, verify all identified persistence mechanisms have been removed, check for additional persistence that may have been missed, confirm services, tasks, and registry entries are clean, monitor for re-infection indicators.\n\n## Output Format\n\n```\nPersistence Investigation Summary:\n  System: DESKTOP-ABC123 (Windows 10 Pro)\n  Analysis Date: 2024-01-20\n\n  Persistence Mechanisms Found:\n    Registry Run Keys (HKLM):    5 entries (1 SUSPICIOUS)\n    Registry Run Keys (HKCU):    3 entries (1 SUSPICIOUS)\n    Services (Auto-Start):       142 entries (2 SUSPICIOUS)\n    Scheduled Tasks:             67 entries (3 SUSPICIOUS)\n    WMI Subscriptions:           1 entry (SUSPICIOUS)\n    Startup Folder:              4 items (1 SUSPICIOUS)\n    COM Objects:                 0 hijacked entries\n    DLL Hijacking:               0 detected\n\n  Suspicious Entries:\n    1. HKCU\\Run\\WindowsUpdate -> powershell -ep bypass -e \u003Cbase64>\n       Timestamp: 2024-01-15 14:35:00\n       Action: Encoded PowerShell download cradle\n\n    2. Service: WinDefenderUpdate -> C:\\ProgramData\\svc\\update.exe\n       Timestamp: 2024-01-15 14:40:00\n       Action: Unknown executable in ProgramData\n\n    3. Task: \\Microsoft\\Windows\\Maintenance\\SecurityUpdate\n       Command: cmd.exe \u002Fc powershell -w hidden -e \u003Cbase64>\n       Trigger: On system startup\n\n    4. WMI: __EventFilter \"ProcessStart\" -> CommandLineEventConsumer\n       Action: Execute C:\\Windows\\Temp\\svc.exe on WMI event\n\n  Remediation Required: 4 persistence mechanisms to remove\n  Report: \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fpersistence_report.txt\n```\n",{"name":5,"tags":25,"author":33,"domain":34,"license":15,"version":35,"subdomain":36,"description":7},[26,27,28,29,30,31,32],"forensics","malware-persistence","autoruns","registry","scheduled-tasks","rootkit-detection","incident-response","mahipal","cybersecurity","1.0","digital-forensics","main","99825ad3f3bcc6597ddcc7294a14e6e922f2b67b","skills\u002Fperforming-malware-persistence-investigation",0,"https:\u002F\u002Fgithub.com\u002Fjukeyman\u002Fjukeyman-skills","https:\u002F\u002Fgithub.com\u002Fjukeyman","https:\u002F\u002FRJBUSINESSSOLUTIONS.ORG","Credit and Finance Expert | Developer\r\n\r\nI'm Rick Jefferson, a seasoned credit and finance expert with over a decade of experience in financial literacy,","2026-07-13 07:03:29",{"source":8,"skillName":5,"commands":47,"prompt":57,"zipAvailable":58},[48,51,54],{"tool":49,"command":50},"npx","npx skills add jukeyman\u002Fjukeyman-skills --skill performing-malware-persistence-investigation",{"tool":52,"command":53},"bunx","bunx skills add jukeyman\u002Fjukeyman-skills --skill performing-malware-persistence-investigation",{"tool":55,"command":56},"pnpm","pnpm dlx skills add jukeyman\u002Fjukeyman-skills --skill performing-malware-persistence-investigation","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fjukeyman\u002Fjukeyman-skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-malware-persistence-investigation\u002FSKILL.md",true,[60,64,70],{"path":61,"resourceType":61,"resourceTypeDesc":62,"sizeBytes":63,"sourceHtmlUrl":16},"LICENSE","许可证",11255,{"path":65,"resourceType":66,"resourceTypeDesc":67,"sizeBytes":68,"sourceHtmlUrl":69},"references\u002Fapi-reference.md","REFERENCE","参考文档",1896,"https:\u002F\u002Fgithub.com\u002Fjukeyman\u002Fjukeyman-skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-malware-persistence-investigation\u002Freferences\u002Fapi-reference.md",{"path":71,"resourceType":72,"resourceTypeDesc":73,"sizeBytes":74,"sourceHtmlUrl":75},"scripts\u002Fagent.py","SCRIPT","脚本",9488,"https:\u002F\u002Fgithub.com\u002Fjukeyman\u002Fjukeyman-skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-malware-persistence-investigation\u002Fscripts\u002Fagent.py",[77,85,92,99,106,114],{"skillNo":78,"name":79,"nameZh":6,"description":80,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":81,"licenseFileUrl":6,"sourceHtmlUrl":82,"categories":83,"keywords":84,"publishedAt":20},"01M79ANS2SM329NEP5ZCX106RR","zustand-store-creator","Create zustand store creator operations. Auto-activating skill for Frontend Development.\nTriggers on: zustand store creator, zustand store creator\nPart of the Frontend Development skill category. Use when working with zustand store creator functionality. Trigger with phrases like \"zustand store creator\", \"zustand creator\", \"zustand\".","MIT","https:\u002F\u002Fgithub.com\u002Fjukeyman\u002Fjukeyman-skills\u002Fblob\u002Fmain\u002Fskills\u002Fzustand-store-creator\u002FSKILL.md",[],[],{"skillNo":86,"name":87,"nameZh":6,"description":88,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":81,"licenseFileUrl":6,"sourceHtmlUrl":89,"categories":90,"keywords":91,"publishedAt":20},"01M79AMZKP4YDEZ7EHG1Y7PP74","zero-trust-config-helper","Configure with zero trust config helper operations. Auto-activating skill for Security Advanced.\nTriggers on: zero trust config helper, zero trust config helper\nPart of the Security Advanced skill category. Use when configuring systems or services. Trigger with phrases like \"zero trust config helper\", \"zero helper\", \"zero\".","https:\u002F\u002Fgithub.com\u002Fjukeyman\u002Fjukeyman-skills\u002Fblob\u002Fmain\u002Fskills\u002Fzero-trust-config-helper\u002FSKILL.md",[],[],{"skillNo":93,"name":94,"nameZh":6,"description":95,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":81,"licenseFileUrl":6,"sourceHtmlUrl":96,"categories":97,"keywords":98,"publishedAt":20},"01M79AMJSBCEJQNBTYNAHYN5HM","zapier-integration-helper","Assist with zapier integration helper operations. Auto-activating skill for Business Automation.\nTriggers on: zapier integration helper, zapier integration helper\nPart of the Business Automation skill category. Use when working with APIs or building integrations. Trigger with phrases like \"zapier integration helper\", \"zapier helper\", \"zapier\".","https:\u002F\u002Fgithub.com\u002Fjukeyman\u002Fjukeyman-skills\u002Fblob\u002Fmain\u002Fskills\u002Fzapier-integration-helper\u002FSKILL.md",[],[],{"skillNo":100,"name":101,"nameZh":6,"description":102,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":81,"licenseFileUrl":6,"sourceHtmlUrl":103,"categories":104,"keywords":105,"publishedAt":20},"01M79AHJZGVMARS13VFQYRR1MP","yaml-config-validator","Validate yaml config validator operations. Auto-activating skill for DevOps Basics.\nTriggers on: yaml config validator, yaml config validator\nPart of the DevOps Basics skill category. Use when configuring systems or services. Trigger with phrases like \"yaml config validator\", \"yaml validator\", \"yaml\".","https:\u002F\u002Fgithub.com\u002Fjukeyman\u002Fjukeyman-skills\u002Fblob\u002Fmain\u002Fskills\u002Fyaml-config-validator\u002FSKILL.md",[],[],{"skillNo":107,"name":108,"nameZh":6,"description":109,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":81,"licenseFileUrl":110,"sourceHtmlUrl":111,"categories":112,"keywords":113,"publishedAt":20},"01M79AHGDZRN0020RDQSQDPAM8","xvary-stock-research","Thesis-driven equity analysis from public SEC EDGAR and market data; \u002Fanalyze, \u002Fscore, \u002Fcompare workflows with bundled Python tools (Claude Code, Cursor, Codex).","https:\u002F\u002Fgithub.com\u002Fjukeyman\u002Fjukeyman-skills\u002Fblob\u002Fmain\u002Fskills\u002Fxvary-stock-research\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fjukeyman\u002Fjukeyman-skills\u002Fblob\u002Fmain\u002Fskills\u002Fxvary-stock-research\u002FSKILL.md",[],[],{"skillNo":115,"name":116,"nameZh":6,"description":117,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":81,"licenseFileUrl":6,"sourceHtmlUrl":118,"categories":119,"keywords":120,"publishedAt":20},"01M79AHCYJ9FV9RMHQ24HDRN33","xss-vulnerability-scanner","Scan xss vulnerability scanner operations. Auto-activating skill for Security Fundamentals.\nTriggers on: xss vulnerability scanner, xss vulnerability scanner\nPart of the Security Fundamentals skill category. Use when working with xss vulnerability scanner functionality. Trigger with phrases like \"xss vulnerability scanner\", \"xss scanner\", \"xss\".","https:\u002F\u002Fgithub.com\u002Fjukeyman\u002Fjukeyman-skills\u002Fblob\u002Fmain\u002Fskills\u002Fxss-vulnerability-scanner\u002FSKILL.md",[],[]]