hunting-for-persistence-mechanisms-in-windows

To hunt for Windows persistence mechanisms, this Skill queries registry keys, services, scheduled tasks, and WMI subscriptions to systematically identify adversary persistence. It collects artifacts using EDR, Sysmon, or Velociraptor and compares them against known-good baselines to find anomalies.

When threat hunting for Windows persistence, check registry keys, services, scheduled tasks, and WMI subscriptions. This Skill enumerates these known persistence points across endpoints, correlating the collected entries with process activity to document findings for remediation.

Yes, enumerating registry persistence keys requires Sysmon, Windows Security Event forwarding, and an EDR solution with registry and file monitoring capabilities. These dependencies are necessary to collect current persistence artifacts and successfully identify unauthorized persistent software.

Yes, you can use Velociraptor for persistence enumeration on Windows. This Skill uses Velociraptor, Sysmon, or EDR to collect current persistence artifacts from endpoints and then compares that data against known-good baselines to identify anomalous entries.

Baseline comparison identifies unauthorized persistent software by collecting current persistence artifacts from Windows endpoints and comparing them against known-good baselines. This process highlights anomalies in registry keys, services, scheduled tasks, and WMI subscriptions for further investigation.

The best way to document findings for Windows persistence mechanisms is to correlate the identified persistence entries with process activity. This Skill systematically investigates unauthorized persistent software and documents the correlated findings for remediation.