npx claudepluginhub plurigrid/asi --plugin asiThis skill uses the workspace's default tool permissions.
Attackers use Windows startup folders for persistence (MITRE ATT&CK T1547.001 — Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder). Files placed in `%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup` or `C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup` execute automatically at user logon. This skill scans startup directories for suspicious files, monitors ...
Detects Windows startup folder persistence (T1547.001) by scanning directories for suspicious files, analyzing autoruns, and real-time monitoring with Python watchdog. For threat hunting and SOC analysis.
Detects T1547.001 Windows startup folder persistence by monitoring suspicious file creations, analyzing autoruns entries, and using Python watchdog for real-time filesystem monitoring.
Hunts adversary persistence mechanisms in Windows endpoints via registry run keys, services, scheduled tasks, startup folders, WMI subscriptions. For threat hunting, incident response, security assessments.
Share bugs, ideas, or general feedback.
Attackers use Windows startup folders for persistence (MITRE ATT&CK T1547.001 — Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder). Files placed in %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup or C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup execute automatically at user logon. This skill scans startup directories for suspicious files, monitors for real-time changes using Python watchdog, and analyzes file metadata to detect persistence implants.
watchdog, pefile (optional for PE analysis)