Ready to supercharge your AI agents?

Install any skill in seconds. Free to start, no credit card required.

Get Started Free →

Hunting For Registry Persistence Mechanisms · mukul975 | DecimalAI

Hunting For Registry Persistence Mechanisms

SkillScore28Maintained

hunting-for-registry-persistence-mechanisms

Hunt for registry-based persistence mechanisms including Run keys, Winlogon modifications, IFEO injection, and COM hijacking in Windows environments.

Securityby mukul975

Links this skill to your agents and keeps it current with the author’s updates.

Automatic

Security & AppSec pack

1 · One-time — install the CLI (docs ↗)

pip install decimalai

2 · Get the skill — writes .claude/skills/hunting-for-registry-persistence-mechanisms/SKILL.md

decimalai skills pull hunting-for-registry-persistence-mechanisms --out .claude/skills/

No CLI? Get the same file — curl · raw file

curl -fsSL --create-dirs -o .claude/skills/hunting-for-registry-persistence-mechanisms/SKILL.md https://app.decimal.ai/s/hunting-for-registry-persistence-mechanisms/SKILL.md

Raw file: /s/hunting-for-registry-persistence-mechanisms/SKILL.md ↗ · machine-readable summary at /s/hunting-for-registry-persistence-mechanisms.json ↗

In productionGlobal

how this skill behaves on real traffic · last 30 days

No production data for this skill yet — usage numbers appear here once agents start running it.

Anonymized aggregate across every org using this skill — proof from real production use, not a demo.

Does this skill help? · Benchmark: with vs. withoutsign in to run this on your agents

25 test cases from the publisher’s eval.yaml · each run twice on gemini-3.6-flash — with the skill injected, then without · last run 55d ago

Yes — +24% lift+18% tokens0% turns28% of whole cases pass with skill (7/25)

Test case	Without → With	Effect	Δ tokens	Δ turns
case-02	✗→✓	▲ Improved	—	—
case-19	✗→✓	▲ Improved	—	—
case-03	✗→✓	▲ Improved	—	—
case-15	✗→✓	▲ Improved	—	—
case-01	✗→✓	▲ Improved	—	—

Showing 5 of 25 cases

SkillSafety

✓ 3 of 3 passed

Code scan15 of 15 checks clean

0 critical · 0 warning · 0 info — scanner v4 — 7/30/2026

live_secretremote_code_executionreverse_shelldata_exfiltrationssrf_metadataagent_snoopinganti_refusaldestructive_commandsobfuscated_unicodeunicode_homoglyphopaque_blobsuspicious_urltool_overreachtrigger_abuseprompt_injection_phrasing

IntentSafe

LLM judge · does the skill do what it claims

ContentClean

LLM judge · policy & harmful-content review

Source

Imported

mukul975 / Anthropic-Cybersecurity-Skills

skills/hunting-for-registry-persistence-mechanisms/SKILL.md

View on GitHub ↗

License Apache-2.0Imported 8/8/2026Version v1Bundled 6 files · scripts

Skill contents

scripts/

references/

assets/

SKILL.md

Hunting For Registry Persistence Mechanisms

When to Use

When proactively hunting for indicators of hunting for registry persistence mechanisms in the environment
After threat intelligence indicates active campaigns using these techniques
During incident response to scope compromise related to these techniques
When EDR or SIEM alerts trigger on related indicators
During periodic security assessments and purple team exercises

Prerequisites

EDR platform with process and network telemetry (CrowdStrike, MDE, SentinelOne)
SIEM with relevant log data ingested (Splunk, Elastic, Sentinel)
Sysmon deployed with comprehensive configuration
Windows Security Event Log forwarding enabled
Threat intelligence feeds for IOC correlation

Workflow

Formulate Hypothesis: Define a testable hypothesis based on threat intelligence or ATT&CK gap analysis.
Identify Data Sources: Determine which logs and telemetry are needed to validate or refute the hypothesis.
Execute Queries: Run detection queries against SIEM and EDR platforms to collect relevant events.
Analyze Results: Examine query results for anomalies, correlating across multiple data sources.
Validate Findings: Distinguish true positives from false positives through contextual analysis.
Correlate Activity: Link findings to broader attack chains and threat actor TTPs.
Document and Report: Record findings, update detection rules, and recommend response actions.

Key Concepts

| Concept | Description | |---------|-------------| | T1547.001 | Registry Run Keys | | T1547.004 | Winlogon Helper DLL | | T1546.012 | IFEO Injection | | T1546.015 | COM Hijacking |

Tools & Systems

| Tool | Purpose | |------|---------| | CrowdStrike Falcon | EDR telemetry and threat detection | | Microsoft Defender for Endpoint | Advanced hunting with KQL | | Splunk Enterprise | SIEM log analysis with SPL queries | | Elastic Security | Detection rules and investigation timeline | | Sysmon | Detailed Windows event monitoring | | Velociraptor | Endpoint artifact collection and hunting | | Sigma Rules | Cross-platform detection rule format |

Common Scenarios

Scenario 1: Malware adding HKCU Run key for user-level persistence
Scenario 2: Adversary modifying Winlogon Shell for system-level persistence
Scenario 3: IFEO debugger injection for accessibility feature backdoor
Scenario 4: COM object InprocServer32 hijack for DLL loading

Output Format

Hunt ID: TH-HUNTIN-[DATE]-[SEQ]
Technique: T1547.001
Host: [Hostname]
User: [Account context]
Evidence: [Log entries, process trees, network data]
Risk Level: [Critical/High/Medium/Low]
Confidence: [High/Medium/Low]
Recommended Action: [Containment, investigation, monitoring]

Illustrative Want to see what hunting-for-registry-persistence-mechanisms would put in front of your model? Preview the rendered body and check its trigger phrases — no LLM call, no signup.

Latest benchmark · publisher runVerified

7/28/2026, 03:20 UTC · 25 cases

Lift

+24%

28% vs 4%

Agent turns

0%

1.0 vs 1.0

Tokens

+18%

1,935.64 vs 1,636.56

fail → pass · 6pass → pass · 1fail → fail · 18

Per-case results (25)

Case	Status	Duration (ms)			Turns			Tokens			Tool calls
Case	Status	Without	With	Δ	Without	With	Δ	Without	With	Δ	Without	With	Δ
case-02 Our SOC team received threat intelligence about adversaries deploying image file execution options (IFEO) debugger backdoors and COM object hijacks. I need you to execute a threat hunting process for registry-based persistence in our environment. Provide the output structured with Hunt ID, MITRE technique, affected host, user account, telemetry evidence, risk level, confidence score, and recommended next actions.	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-19 While analyzing registry modification queries, a hunter sees 100 hosts updating Run keys due to a Chrome enterprise update and 1 host updating a Run key from AppData\Local\Temp. Which workflow step involves distinguishing these benign baseline updates from genuine attacks?	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-24 In what relative order should a threat hunter perform query execution against EDR platforms compared to result analysis in the hunt workflow?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-22 In the standard output format for hunt reports, which field specifies the operational actions to take, such as containment or monitoring?	pass→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-23 Which SIEM platforms are explicitly recognized as primary log analysis destinations in the threat hunting setup?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-21 Why is detecting a registry write alone insufficient to confirm compromise, and what specific step in the hunt workflow connects host telemetry to execution logs and network traffic?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-11 During a purple team assessment, an engineer configured a Debugger string value under HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options for sethc.exe. What MITRE ATT&CK technique code categorizes IFEO injection?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-04 We confirmed a malicious binary persistence entry under HKCU\Software\Microsoft\Windows\CurrentVersion\Run pointing to C:\Users\Public\update.exe. Provide a PowerShell remediation script to remove the registry key, terminate the running process, and delete the payload file.	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-16 A hunt on server FILE-SRV-01 revealed an unapproved edit modifying the Winlogon Shell value under account SYSTEM. Generate the completed threat hunt summary output block.	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-05 During an incident response engagement, we dumped physical memory from a suspect host to analyze injected code in LSASS memory space using Volatility 3. Provide the Volatility plugin commands to inspect process memory and extract malicious code payloads.	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-08 When our security operations team needs to collect deep endpoint artifacts and forensic evidence directly from Windows hosts during a hunt, which specialized artifact collection tool listed in the hunt tools table is designed for this purpose?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-03 A Defender for Endpoint query flagged an unexpected modification to the Winlogon Shell entry on domain controller DC-PROD-02. Please investigate this potential system-level persistence mechanism using our log sources and document your findings showing the hunt identifier, technique code, impacted system and user, correlated evidence, assessed risk level, confidence rating, and mitigation recommendations.	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-09 We are building telemetry search rules for user-level auto-run startup keys added by malware after initial execution. What specific registry path under HKCU and what associated MITRE ATT&CK technique ID apply to standard Run key persistence?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-20 Our threat hunting unit wants to write detection rules that can be shared across heterogeneous SIEM and EDR tools including Splunk, MDE, and Elastic. Which detection rule standard listed in the toolset enables vendor-neutral rule writing?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-18 Telemetry on endpoint ENG-LAPTOP-15 indicated a user-level COM object InprocServer32 hijacking attempt for user mdev. Format the final hunt output block.	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-15 A threat hunt identified malware adding a payload value to HKCU\Software\Microsoft\Windows\CurrentVersion\Run on endpoint WORKSTATION-12 for user jdoe. Produce the findings summary using the standard hunt report schema.	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-01 We noticed suspicious registry modifications on host WORKSTATION-09 under the HKCU Run key following a phishing alert. Walk me through investigating this registry persistence attempt across our EDR and SIEM data, and give me a summary report including the Hunt ID, targeted technique, host name, user account context, evidence gathered, risk severity, confidence rating, and suggested containment steps.	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-14 Our SIEM engineering team is verifying prerequisites before launching a registry hunt campaign. What specific endpoint log auditing utility must be configured and forwarded alongside Windows Security Event logs?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-13 When reviewing Sysmon telemetry ingested into a SIEM platform, which specific Sysmon event types record registry key creation and value modification events?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-06 Our Linux infrastructure team suspects an adversary established persistence on an Ubuntu web server using systemd timers or cron jobs. Outline the CLI commands and log files to inspect scheduled tasks and systemd service files on Linux.	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-07 We want to start hunting for registry persistence mechanisms across our endpoint estate using Microsoft Defender. Should we immediately execute wide queries across all registry modifications, or what is the initial operational step in the hunt workflow?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-10 An adversary modified the Userinit string value under HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon to execute a malicious payload at logon. What MITRE technique identifier corresponds to this persistence method?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-17 A hunt uncovered an IFEO key entry setting a Debugger binary for utilman.exe on host HOST-FIN-04. Provide the hunt output adhering strictly to the structured output template.	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-12 Threat hunting telemetry flagged a non-admin account creating an InprocServer32 key path under HKCU\Software\Classes\CLSID to force a legitimate application to load a malicious DLL. What technique code classifies COM hijacking?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-25 What are the four valid severity options defined for the Risk Level field in the threat hunt output schema?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—

These cases were also screened by the skill’s intent / safety pass.See the Trust review ↗Reproduce this benchmark in Colab ↗

How this skill was measured

DecimalAI ran this skill against gemini-3.6-flash twice over the same eval suite — once with the skill loaded and once without — and compared the two runs case by case. 25 cases were attempted. The headline lift of +24 percentage points is the difference between those two pass rates over the 25 comparable cases.

Model measured: gemini-3.6-flash
Graded by: gemini-3.6-flash
Grading method: judged
Verification: verified
Pass rate without the skill: 4%
Pass rate with the skill: 28%
Cases attempted: 25
Cases counted toward lift: 25
Cases that regressed: 0
Skill version measured: v1
Run completed: 7/28/2026, 03:20 UTC

The per-case answers from this run were removed by the retention sweep, so the case table below shows the verdicts without the text either arm produced. The counts above were recorded at the time and are unaffected. Answers are now kept for 180 days.

SkillScore blends 4 signals1 of 4 complete

BenchmarkPass rate WITH skill on a verified run28

Live evalNeeds ≥10 evaluated traces in 30 days

AI ratingNeeds ≥10 rated traces

AdoptionNeeds ≥10 serves across ≥2 orgs in 30 days

Efficiency · separate axis (at equal correctness)+0% turns+9% tokens

Shown for transparency; not credited unless a verified run shows no correctness regression.

Backed by 1 of 4 signals — each added signal makes the score more robust.

Verified on gemini-3.6-flash · re-tested 55 days ago

Other measured skills in the registry, with their headline benchmark lift.