hunting-for-persistence-mechanisms-in-windows

name	hunting-for-persistence-mechanisms-in-windows
description	Systematically hunt for adversary persistence mechanisms across Windows endpoints including registry, services, startup folders, and WMI subscriptions. Use when working with hunting for persistence mechanisms in windows.
domain	cybersecurity
tags	["threat-hunting","mitre-attack","persistence","windows","registry","siem","proactive-detection"]
subdomain	threat-hunting
version	1.0
author	oyi77
license	Apache-2.0
d3fend_techniques	["Executable Denylisting","Execution Isolation","File Metadata Consistency Validation","Content Format Conversion","File Content Analysis"]
nist_csf	["DE.CM-01","DE.AE-02","DE.AE-07","ID.RA-05"]

Hunting For Persistence Mechanisms In Windows

Overview

Cybersecurity skill for hunting for persistence mechanisms in windows. Follows industry best practices and security standards.

When to Use

Trigger phrases:

• "hunting for persistence mechanisms in windows"

• "Systematically hunt for adversary persistence mechanisms across Windows endpoint"

• During periodic proactive threat hunts for dormant backdoors

• After an incident to identify all persistence mechanisms an attacker planted

• When investigating unusual services, scheduled tasks, or startup entries

• When threat intel reports describe new persistence techniques in the wild

• During security posture assessments to identify unauthorized persistent software

When NOT to Use

• When you lack proper authorization for testing
• For production systems without change management
• When the task requires legal or compliance expertise beyond technical scope

Prerequisites

• Sysmon deployed with Event IDs 12/13/14 (Registry), 19/20/21 (WMI), 1 (Process Creation)
• Windows Security Event forwarding for 4697 (Service Install), 4698 (Scheduled Task)
• EDR with registry and file monitoring capabilities
• PowerShell script block logging enabled (Event ID 4104)
• Autoruns or equivalent baseline of legitimate persistent entries

Workflow

# Example: IOC detection
import re

IOC_PATTERNS = {
    "ip": r"\b(?:\d{1,3}\.){3}\d{1,3}\b",
    "domain": r"\b[a-z0-9-]+\.[a-z]{2,}\b",
    "hash_md5": r"\b[a-f0-9]{32}\b",
    "hash_sha256": r"\b[a-f0-9]{64}\b",
}

def extract_iocs(text: str) -> dict:
    return {k: re.findall(v, text) for k, v in IOC_PATTERNS.items()}