Skill

hunting-for-registry-persistence-mechanisms

From asi

Hunt for Windows registry persistence mechanisms including Run keys, Winlogon modifications, IFEO injection, and COM hijacking. For threat hunting, IR, and security assessments.

security

npx claudepluginhub plurigrid/asi --plugin asi

Tool Access

This skill uses the workspace's default tool permissions.

Preview

- When proactively hunting for indicators of hunting for registry persistence mechanisms in the environment

SKILL.md

Similar Skills

hunting-for-registry-persistence-mechanisms

5.9k

Guides hunting for Windows registry persistence like Run keys, Winlogon mods, IFEO injection, COM hijacking using EDR, SIEM, Sysmon queries.

7 files

cybersecurity-skills

hunting-for-registry-persistence-mechanisms

Hunts Windows registry persistence mechanisms like Run keys, Winlogon mods, IFEO injection, and COM hijacking using EDR/SIEM queries. Useful for threat hunting, incident response, and purple team exercises.

7 files

cybersecurity-skills-zh

hunting-for-persistence-mechanisms-in-windows

Hunts adversary persistence mechanisms in Windows endpoints via registry run keys, services, scheduled tasks, startup folders, WMI subscriptions. For threat hunting, incident response, security assessments.

asi

Stats

Parent Repo Stars16

Parent Repo Forks5

Last CommitApr 4, 2026

Actions

View Source View Plugin View on GitHub View README

Help us improve

Share bugs, ideas, or general feedback.

Hunting For Registry Persistence Mechanisms

When to Use

When proactively hunting for indicators of hunting for registry persistence mechanisms in the environment
After threat intelligence indicates active campaigns using these techniques
During incident response to scope compromise related to these techniques
When EDR or SIEM alerts trigger on related indicators
During periodic security assessments and purple team exercises

Prerequisites

EDR platform with process and network telemetry (CrowdStrike, MDE, SentinelOne)
SIEM with relevant log data ingested (Splunk, Elastic, Sentinel)
Sysmon deployed with comprehensive configuration
Windows Security Event Log forwarding enabled
Threat intelligence feeds for IOC correlation

Workflow

Formulate Hypothesis: Define a testable hypothesis based on threat intelligence or ATT&CK gap analysis.
Identify Data Sources: Determine which logs and telemetry are needed to validate or refute the hypothesis.
Execute Queries: Run detection queries against SIEM and EDR platforms to collect relevant events.
Analyze Results: Examine query results for anomalies, correlating across multiple data sources.
Validate Findings: Distinguish true positives from false positives through contextual analysis.
Correlate Activity: Link findings to broader attack chains and threat actor TTPs.
Document and Report: Record findings, update detection rules, and recommend response actions.

Key Concepts

Concept	Description
T1547.001	Registry Run Keys
T1547.004	Winlogon Helper DLL
T1546.012	IFEO Injection
T1546.015	COM Hijacking

Tools & Systems

Tool	Purpose
CrowdStrike Falcon	EDR telemetry and threat detection
Microsoft Defender for Endpoint	Advanced hunting with KQL
Splunk Enterprise	SIEM log analysis with SPL queries
Elastic Security	Detection rules and investigation timeline
Sysmon	Detailed Windows event monitoring
Velociraptor	Endpoint artifact collection and hunting
Sigma Rules	Cross-platform detection rule format

Common Scenarios

Scenario 1: Malware adding HKCU Run key for user-level persistence
Scenario 2: Adversary modifying Winlogon Shell for system-level persistence
Scenario 3: IFEO debugger injection for accessibility feature backdoor
Scenario 4: COM object InprocServer32 hijack for DLL loading

Output Format

Hunt ID: TH-HUNTIN-[DATE]-[SEQ]
Technique: T1547.001
Host: [Hostname]
User: [Account context]
Evidence: [Log entries, process trees, network data]
Risk Level: [Critical/High/Medium/Low]
Confidence: [High/Medium/Low]
Recommended Action: [Containment, investigation, monitoring]