Hunts attacker persistence mechanisms in Windows endpoints covering registry Run keys, services, startup folders, and WMI event subscriptions. For threat hunting and incident response.
npx claudepluginhub killvxk/cybersecurity-skills-zhThis skill uses the workspace's default tool permissions.
- 针对潜伏后门进行定期主动威胁狩猎时
Hunts persistence mechanisms in Windows endpoints including registry run keys, services, scheduled tasks, startup folders, WMI subscriptions. For threat hunting, incident response, and posture assessments.
Hunts adversary persistence mechanisms in Windows endpoints via registry run keys, services, scheduled tasks, startup folders, WMI subscriptions. For threat hunting, incident response, security assessments.
Investigates malware persistence mechanisms on Windows and Linux systems by enumerating registry keys, services, autoruns, scheduled tasks, and rootkits for incident response, threat hunting, and forensics.
Share bugs, ideas, or general feedback.
| 概念 | 描述 |
|---|---|
| T1547.001 | 注册表 Run 键 / 启动文件夹 |
| T1543.003 | Windows 服务（创建或修改） |
| T1053.005 | 计划任务 |
| T1546.003 | WMI 事件订阅 |
| T1546.015 | 组件对象模型（COM）劫持 |
| T1546.012 | 映像文件执行选项注入 |
| T1546.010 | AppInit DLL |
| T1547.004 | Winlogon 辅助 DLL |
| T1547.005 | 安全支持提供程序 |
| T1574.001 | DLL 搜索顺序劫持 |
| TA0003 | 持久化战术 |
| Autoruns | Sysinternals 工具，用于显示持久化条目 |
| 工具 | 用途 |
|---|---|
| Sysinternals Autoruns | 全面的持久化枚举 |
| Velociraptor | 终端范围的持久化工件收集 |
| CrowdStrike Falcon | 实时持久化监控 |
| Sysmon | 注册表和 WMI 事件监控 |
| OSQuery | 基于 SQL 的持久化查询 |
| RECmd | 用于取证分析的注册表资源管理器 |
| Splunk | SIEM 持久化事件关联 |
HKCU\Software\Microsoft\Windows\CurrentVersion\Run 中添加条目，指向 %APPDATA% 中的载荷。sc create 创建指向后门二进制文件的 Windows 服务。狩猎 ID：TH-PERSIST-[日期]-[序号]
持久化类型：[注册表/服务/任务/WMI/COM/其他]
MITRE 技术：T1547.xxx / T1543.xxx / T1053.xxx
位置：[完整注册表键 / 服务名称 / 任务路径]
值：[二进制路径 / 命令行]
主机：[受影响终端]
已签名：[是/否]
哈希：[SHA256]
创建时间：[时间戳]
风险等级：[严重/高/中/低]
结论：[恶意/可疑/良性]