Ready to supercharge your AI agents?

Install any skill in seconds. Free to start, no credit card required.

Hunting for Persistence Mechanisms in Windows · mukul975 | DecimalAI

Hunting For Persistence Mechanisms In Windows

SkillScore18Maintained

hunting-for-persistence-mechanisms-in-windows

Systematically hunt for adversary persistence mechanisms across Windows endpoints including registry, services, startup folders, and WMI subscriptions.

Securityby mukul975

Links this skill to your agents and keeps it current with the author’s updates.

Automatic

Security & AppSec pack

1 · One-time — install the CLI (docs ↗)

pip install decimalai

2 · Get the skill — writes .claude/skills/hunting-for-persistence-mechanisms-in-windows/SKILL.md

decimalai skills pull hunting-for-persistence-mechanisms-in-windows --out .claude/skills/

No CLI? Get the same file — curl · raw file

curl -fsSL --create-dirs -o .claude/skills/hunting-for-persistence-mechanisms-in-windows/SKILL.md https://app.decimal.ai/s/hunting-for-persistence-mechanisms-in-windows/SKILL.md

Raw file: /s/hunting-for-persistence-mechanisms-in-windows/SKILL.md ↗ · machine-readable summary at /s/hunting-for-persistence-mechanisms-in-windows.json ↗

In productionGlobal

how this skill behaves on real traffic · last 30 days

No production data for this skill yet — usage numbers appear here once agents start running it.

Anonymized aggregate across every org using this skill — proof from real production use, not a demo.

Does this skill help? · Benchmark: with vs. withoutsign in to run this on your agents

22 test cases from the publisher’s eval.yaml · each run twice on gemini-3.6-flash — with the skill injected, then without · last run 55d ago

Yes — +18% lift · at higher cost+76% tokens0% turns18% of whole cases pass with skill (4/22)

Test case	Without → With	Effect	Δ tokens	Δ turns
case-02	✗→✓	▲ Improved	—	—
case-04	✗→✓	▲ Improved	—	—
case-01	✗→✓	▲ Improved	—	—
case-03	✗→✓	▲ Improved	—	—
case-10	✗→✗	＝ Same ✗	—	—

Showing 5 of 22 cases

SkillSafety

✓ 3 of 3 passed

Code scan15 of 15 checks clean

0 critical · 0 warning · 0 info — scanner v4 — 7/30/2026

live_secretremote_code_executionreverse_shelldata_exfiltrationssrf_metadataagent_snoopinganti_refusaldestructive_commandsobfuscated_unicodeunicode_homoglyphopaque_blobsuspicious_urltool_overreachtrigger_abuseprompt_injection_phrasing

IntentSafe

LLM judge · does the skill do what it claims

ContentClean

LLM judge · policy & harmful-content review

Source

Imported

mukul975 / Anthropic-Cybersecurity-Skills

skills/hunting-for-persistence-mechanisms-in-windows/SKILL.md

View on GitHub ↗

License Apache-2.0Imported 8/8/2026Version v1Bundled 6 files · scripts

Skill contents

scripts/

references/

assets/

SKILL.md

Hunting for Persistence Mechanisms in Windows

When to Use

During periodic proactive threat hunts for dormant backdoors
After an incident to identify all persistence mechanisms an attacker planted
When investigating unusual services, scheduled tasks, or startup entries
When threat intel reports describe new persistence techniques in the wild
During security posture assessments to identify unauthorized persistent software

Prerequisites

Sysmon deployed with Event IDs 12/13/14 (Registry), 19/20/21 (WMI), 1 (Process Creation)
Windows Security Event forwarding for 4697 (Service Install), 4698 (Scheduled Task)
EDR with registry and file monitoring capabilities
PowerShell script block logging enabled (Event ID 4104)
Autoruns or equivalent baseline of legitimate persistent entries

Workflow

Enumerate Known Persistence Locations: Build a comprehensive list of Windows persistence points (Run keys, services, scheduled tasks, WMI, startup folder, DLL search order, COM hijacks, AppInit DLLs, Image File Execution Options).
Collect Endpoint Data: Use EDR, Sysmon, or Velociraptor to collect current persistence artifacts from endpoints across the environment.
Baseline Legitimate Persistence: Compare collected data against known-good baselines (Autoruns snapshots, GPO-deployed entries, SCCM configurations).
Identify Anomalies: Flag new, unsigned, or unknown entries in persistence locations that deviate from the baseline.
Investigate Suspicious Entries: For each anomaly, examine the binary it points to, its digital signature, file hash, and creation timestamp.
Correlate with Process Activity: Link persistence entries to process execution, network activity, and user login events.
Document and Remediate: Record findings, remove malicious persistence, and update detection rules.

Key Concepts

| Concept | Description | |---------|-------------| | T1547.001 | Registry Run Keys / Startup Folder | | T1543.003 | Windows Service (Create or Modify) | | T1053.005 | Scheduled Task | | T1546.003 | WMI Event Subscription | | T1546.015 | Component Object Model (COM) Hijacking | | T1546.012 | Image File Execution Options Injection | | T1546.010 | AppInit DLLs | | T1547.004 | Winlogon Helper DLL | | T1547.005 | Security Support Provider | | T1574.001 | DLL Search Order Hijacking | | TA0003 | Persistence Tactic | | Autoruns | Sysinternals tool showing persistent entries |

Tools & Systems

| Tool | Purpose | |------|---------| | Sysinternals Autoruns | Comprehensive persistence enumeration | | Velociraptor | Endpoint-wide persistence artifact collection | | CrowdStrike Falcon | Real-time persistence monitoring | | Sysmon | Registry and WMI event monitoring | | OSQuery | SQL-based persistence queries | | RECmd | Registry Explorer for forensic analysis | | Splunk | SIEM correlation of persistence events |

Common Scenarios

Registry Run Key Backdoor: Malware adds HKCU\Software\Microsoft\Windows\CurrentVersion\Run entry pointing to payload in %APPDATA%.
WMI Event Subscription: Adversary creates WMI consumer/filter pair that executes PowerShell on system boot.
Malicious Service: Attacker creates Windows service with sc create pointing to a backdoor binary.
COM Object Hijack: Legitimate COM CLSID InprocServer32 path replaced with malicious DLL.
IFEO Debugger Injection: Image File Execution Options key set with debugger pointing to implant for common utilities.

Output Format

Hunt ID: TH-PERSIST-[DATE]-[SEQ]
Persistence Type: [Registry/Service/Task/WMI/COM/Other]
MITRE Technique: T1547.xxx / T1543.xxx / T1053.xxx
Location: [Full registry key / service name / task path]
Value: [Binary path / command line]
Host(s): [Affected endpoints]
Signed: [Yes/No]
Hash: [SHA256]
Creation Time: [Timestamp]
Risk Level: [Critical/High/Medium/Low]
Verdict: [Malicious/Suspicious/Benign]

Illustrative Want to see what hunting-for-persistence-mechanisms-in-windows would put in front of your model? Preview the rendered body and check its trigger phrases — no LLM call, no signup.

Latest benchmark · publisher runVerified

7/28/2026, 03:08 UTC · 22 cases

Lift

+18%

18% vs 0%

Agent turns

1.0 vs 1.0

Tokens

+76%

2,007 vs 1,138.45

fail → pass · 4fail → fail · 18

Per-case results (22)

Case	Status	Duration (ms)			Turns			Tokens			Tool calls
Case	Status	Without	With	Δ	Without	With	Δ	Without	With	Δ	Without	With	Δ
case-02 Our SIEM flagged unusual scheduled tasks and WMI event consumer modifications on several domain servers. Perform an endpoint persistence analysis on the gathered telemetry logs and format your output according to the standard hunt schema, detailing the Hunt ID, persistence classification, associated MITRE ID, location path, payload command value, affected hosts, digital signing status, hash, creation timestamp, risk evaluation, and verdict.	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-10 Threat actors modified the `InprocServer32` registry entry for a commonly loaded CLSID to redirect loading to a custom DLL in `C:\Users\Public`. Which MITRE ATT&CK sub-technique ID corresponds to Component Object Model hijacking?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-06 Write a YARA detection rule to identify a compiled C++ reverse shell binary on disk based on hardcoded mutex strings and PE header flags.	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-04 We suspect a Linux server in our DMZ has persistent access established via cron jobs or systemd timers. Analyze the `/etc/crontab` output provided below and report any unauthorized persistence commands.	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-19 Which Windows Security Event ID is generated whenever a new scheduled task is created in Task Scheduler?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-20 When PowerShell script block logging is enabled to inspect decoded base64 commands, under what Event ID are the script blocks recorded in Microsoft-Windows-PowerShell/Operational?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-12 Investigation revealed custom DLL paths added to `HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs`. Which MITRE ATT&CK sub-technique ID tracks AppInit DLLs persistence?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-08 An attacker used `sc.exe create` to establish a persistent service named `WinUpdateSvc` pointing to an executable in `C:\ProgramData`. Identify the corresponding MITRE ATT&CK sub-technique ID for Windows services creation or modification.	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-01 We noticed suspicious auto-start activity on several workstation endpoints where an unsigned binary was launched from AppData. Please conduct a threat hunt on our collected endpoint registry data to identify persistent run key backdoors. Output the findings using the required structure showing the Hunt ID, Persistence Type, MITRE Technique, Location, Value, Host(s), Signed status, Hash, Creation Time, Risk Level, and Verdict.	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-17 To detect malicious WMI event consumers and filters, which Event IDs in Sysmon must be monitored and forwarded to the SIEM?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-21 Which command-line forensic utility designed by Eric Zimmerman is commonly used to parse offline NTUSER.DAT and SYSTEM hives for registry persistence artifacts during deep forensic analysis?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-22 We detected an unexpected entry in `HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce`. Under the standard persistence hunting report schema, what generic primary category keyword should be assigned to the Persistence Type field?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-11 During registry analysis, the `Debugger` value under `HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe` was set to point to `cmd.exe`. What MITRE ATT&CK sub-technique covers Image File Execution Options injection?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-07 An analyst observed a suspicious WMI filter and consumer binding created to launch a script upon system boot. What is the specific MITRE ATT&CK sub-technique ID associated with WMI event subscriptions?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-03 Following a suspected intrusion, we need to search for hidden persistence mechanisms such as COM object hijacks and malicious service installs on host WORKSTATION-09. Run the persistence hunt procedure and report the results containing the Hunt ID, type of persistence, MITRE technique reference, artifact location, registry/command value, targeted host, digital signature flag, SHA256 hash, creation time, risk level, and final verdict.	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-13 An attacker modified the `Userinit` registry value under Winlogon to append a path to a malicious executable. What MITRE ATT&CK sub-technique ID represents Winlogon Helper DLL persistence?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-16 We are configuring Sysmon configuration XML rules to capture registry modifications related to auto-start points. Which specific Sysmon Event IDs track registry object creation, modification, key/value renaming, and deletion?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-09 A scheduled task named `GoogleUpdateTask` was added to run every hour executing a PowerShell payload. What MITRE ATT&CK sub-technique code designates scheduled task persistence?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-05 We captured a 50MB PCAP file from a workstation attempting DNS tunneling to an external IP address. Analyze the packet capture to determine the command and control protocol details and domain names.	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-14 An adversary added a custom LSA security package into the registry under `HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Security Packages`. What MITRE ATT&CK sub-technique code covers Security Support Provider persistence?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-15 A vulnerable application loads `version.dll` from its local execution folder instead of `System32`, executing an unverified payload. What MITRE ATT&CK sub-technique ID tracks DLL search order hijacking?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-18 When a new service is installed on a Windows server, which standard Windows Security Event Log ID is generated to capture the service creation?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—

These cases were also screened by the skill’s intent / safety pass.See the Trust review ↗Reproduce this benchmark in Colab ↗

How this skill was measured

DecimalAI ran this skill against gemini-3.6-flash twice over the same eval suite — once with the skill loaded and once without — and compared the two runs case by case. 22 cases were attempted. The headline lift of +18 percentage points is the difference between those two pass rates over the 22 comparable cases.

Model measured: gemini-3.6-flash
Graded by: gemini-3.6-flash
Grading method: judged
Verification: verified
Pass rate without the skill: 0%
Pass rate with the skill: 18.2%
Cases attempted: 22
Cases counted toward lift: 22
Cases that regressed: 0
Skill version measured: v1
Run completed: 7/28/2026, 03:08 UTC

The per-case answers from this run were removed by the retention sweep, so the case table below shows the verdicts without the text either arm produced. The counts above were recorded at the time and are unaffected. Answers are now kept for 180 days.

SkillScore blends 4 signals1 of 4 complete

BenchmarkPass rate WITH skill on a verified run18

Live evalNeeds ≥10 evaluated traces in 30 days

AI ratingNeeds ≥10 rated traces

AdoptionNeeds ≥10 serves across ≥2 orgs in 30 days

Backed by 1 of 4 signals — each added signal makes the score more robust.

Verified on gemini-3.6-flash · re-tested 55 days ago

Other measured skills in the registry, with their headline benchmark lift.