skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

performing-malware-persistence-investigation

Enumerate and analyze Windows and Linux persistence mechanisms to identify how malware survives reboots.

954|172|Updated Mar 13, 2026
Search Tags:#incident response#threat hunting#digital forensics#autoruns#WMI#registry analysis#malware persistence
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill performing-malware-persistence-investigation
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: performing-malware-persistence-investigation
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/digital-forensics/performing-malware-persistence-investigation
Command: npx skills add https://github.com/xalgord/xalgorix --skill performing-malware-persistence-investigation

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires python-registry.

What problem does it solve?

Incident responders often miss hidden persistence mechanisms when cleaning compromised systems, allowing malware to survive reboots and reinfect hosts after remediation. This Skill provides a systematic workflow to enumerate registry run keys, services, scheduled tasks, WMI subscriptions, COM hijacks, and Linux autostart vectors so no persistence mechanism is overlooked.

Core Features & Use Cases

  • Windows Persistence Enumeration: Parses registry hives (Run keys, services, NTUSER.DAT), scheduled task XML files, WMI event subscriptions, COM object registrations, and startup folders from forensic images.
  • Linux Persistence Enumeration: Checks cron jobs, systemd services, SSH authorized_keys, rc.local, profile scripts, LD_PRELOAD, kernel modules, and PAM configurations.
  • Suspicious Entry Detection: Flags indicators like encoded PowerShell, LOLBins (certutil, mshta, rundll32), and binaries in temp or ProgramData paths, then compiles a structured persistence report.
  • Use Case: During incident response on a compromised Windows host, mount the forensic image, run the workflow to enumerate all autostart locations, and produce a report listing four suspicious persistence entries requiring removal before declaring remediation complete.

Quick Start

Investigate all persistence mechanisms on the mounted forensic image at /mnt/evidence and generate a report of suspicious autostart entries.

Frequently Asked Questions about performing-malware-persistence-investigation

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I investigate malware persistence on a Windows system?▼

Enumerate registry Run keys, auto-start services, scheduled tasks, WMI event subscriptions, COM object registrations, and startup folders. Tools like Autoruns, RegRipper, and the Python Registry library can parse these locations from live systems or forensic images.

How to find Linux malware persistence mechanisms?▼

Check cron jobs, systemd services and timers, SSH authorized_keys, rc.local, /etc/profile.d scripts, LD_PRELOAD and ld.so.preload, kernel modules, and PAM configurations. Malware commonly hides in these locations beyond simple crontab entries.

What tools detect WMI event subscription persistence?▼

WMI persistence is found by parsing the OBJECTS.DATA repository for __EventFilter, CommandLineEventConsumer, and __FilterToConsumerBinding entries. PyWMIPersistenceFinder and string searches against the WMI repository database can extract these stealthy subscriptions.

Can registry timestamps be trusted during persistence analysis?▼

No, registry LastWrite times and file mtimes can be timestomped by attackers. Corroborate suspected entries against Prefetch, Amcache, Security event logs (4697, 4698, 7045), and verify the on-disk target binary exists and check its signature.

Why does persistence hunting produce false positives?▼

Legitimate software like updaters, drivers, and antivirus use Run keys, services, and scheduled tasks, and a typical host has over 100 auto-start entries. Diff results against a known-good baseline and decode suspicious command arguments before flagging them.

How do I verify malware persistence was fully removed?▼

Re-enumerate all persistence vectors after remediation, not just the ones you cleaned, and compare against a known-good Autoruns baseline. Confirm services, tasks, registry entries, and WMI subscriptions are clean, then monitor for re-infection indicators.

Related Skills

Explore More Software Engineering Skills→
SherifEldeebSherifEldeeb
5

registry-forensics

Parse Windows Registry hives to extract artifacts and generate timelines.

Community
Advanced
balic-AI-ML-R-D-Resourcesbalic-AI-ML-R-D-Resources

yara-authoring

Write and test YARA rules to detect malware samples and threats.

Official
Intermediate
AxxxxxxaaannAxxxxxxaaann

analyzing-memory-dumps-with-volatility

Analyze RAM memory dumps with Volatility 3 to identify malware artifacts.

Community
Advanced
refractionPOINTrefractionPOINT
29

velociraptor

Launch Velociraptor forensic collections on endpoints via LimaCharlie API.

Official
Advanced