hunting-for-persistence-mechanisms-in-windows

What problem does it solve?

This Skill helps security professionals proactively identify and respond to adversary persistence mechanisms in Windows endpoints.

Core Features & Use Cases

• Threat Hunting: Detects and analyzes indicators of compromise across various Windows endpoints.
• Persistence Enumeration: Identifies known persistence points such as registry keys, services, scheduled tasks, and WMI subscriptions.
• Data Collection: Collects current persistence artifacts from endpoints using EDR, Sysmon, or Velociraptor.
• Baseline Comparison: Compares collected data against known-good baselines to identify anomalies.
• Investigation and Documentation: Correlates persistence entries with process activity and documents findings for remediation.
• Use Case: Security analysts can use this Skill during threat hunts, post-incident analysis, or during security posture assessments to identify unauthorized persistent software.

Quick Start

Use the hunting-for-persistence-mechanisms-in-windows skill to enumerate registry persistence keys.