skills.rest
dreadnode
dreadnodeOFFICIAL
Explore all skills by this author →
Website𝕏@dreadnodeGitHub

persistence-hunt

Enumerate Windows memory persistence mechanisms and map them to MITRE ATT&CK technique IDs.

11|1|Updated May 4, 2026
Search Tags:#incident response#volatility#red teaming#windows security#memory forensics#mitre attack#persistence mechanisms
One-click install
npx skills add https://github.com/dreadnode/capabilities --skill persistence-hunt
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: persistence-hunt
Source: https://github.com/dreadnode/capabilities/tree/main/capabilities/memory-forensics/skills/persistence-hunt
Command: npx skills add https://github.com/dreadnode/capabilities --skill persistence-hunt

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill solves the critical gap of identifying long-term attacker footholds in Windows memory dumps that survive system reboots and re-imaging, which is essential for effective post-intrusion scoping and complete incident cleanup.

Core Features & Use Cases

  • Comprehensive Persistence Enumeration: Detects 11 common Windows persistence mechanisms including registry autoruns, services, scheduled tasks, WMI event subscriptions, COM hijacks, IFEO, AppInit DLLs, and kernel drivers.
  • MITRE ATT&CK Mapping: Automatically links identified persistence artifacts to official MITRE ATT&CK technique IDs for standardized, actionable reporting.
  • Use Case: During a confirmed corporate intrusion, use this Skill to scan acquired memory dumps for all persistence artifacts, determine which footholds will survive a full system re-image, and prioritize cleanup efforts to prevent attacker re-access.

Quick Start

Use the persistence-hunt skill to scan a provided Windows memory dump for all persistence mechanisms and generate a prioritized list of surviving artifacts with their associated MITRE ATT&CK technique IDs.

Frequently Asked Questions about persistence-hunt

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I find hidden persistence mechanisms in a Windows memory dump?▼

To map Windows persistence artifacts to MITRE ATT&CK technique IDs, scan acquired memory dumps for footholds like COM hijacks, IFEO, and AppInit DLLs. This automatically links identified artifacts to official technique IDs for standardized reporting and prioritization of cleanup efforts.

Does memory persistence hunting determine if attacker footholds survive a system re-image?▼

Memory forensics for persistence hunting applies to post-intrusion incident response and authorized red teaming scenarios. It uncovers hidden memory persistence by enumerating Windows mechanisms like registry autoruns and WMI event subscriptions to scope long-term attacker footholds.

Can I use memory persistence enumeration for authorized red teaming scenarios?▼

Memory persistence enumeration applies to authorized red teaming scenarios by scoping long-term attacker footholds in Windows memory. It detects registry autoruns, services, WMI event subscriptions, and kernel drivers to identify re-image survivability of artifacts and prioritize cleanup efforts.

What Windows persistence mechanisms can be detected during incident response?▼

Incident response detects 11 common Windows memory persistence mechanisms including registry autoruns, services, scheduled tasks, WMI event subscriptions, COM hijacks, IFEO, AppInit DLLs, and kernel drivers. This comprehensive enumeration identifies surviving artifacts for complete post-intrusion cleanup.

Related Skills

Explore More Data & Analytics Skills→
AI-Foundry-CoreAI-Foundry-Core
4

memory-forensics

Analyze RAM dumps with Volatility 3 to extract processes and artifacts.

Official
Advanced
jassicsjassics
6

attack-lookup

Map observed behaviors to MITRE ATT&CK technique IDs and references.

Community
Intermediate
LeoWSY-hashblueLeoWSY-hashblue
3

dfir

Correlates EVTX, PCAP, memory, and MFT artifacts to reconstruct Windows incident timelines.

Community
Advanced
kiwamizamuraikiwamizamurai
7

forensics

Extract hidden data and forensic artifacts from files using standard tools.

Community
Advanced