persistence-hunter

Windows persistence mechanism scanner. Scans all autorun vectors: Registry Run/RunOnce keys (T1547.001), Startup folders (T1547.004), Scheduled Tasks (T1053.005), and WMI Event Subscriptions (T1546.003). Filters Microsoft-signed noise by default (reduces ~80 legit entries to only suspicious ones). Supports baseline/diff for change detection — save known-good state, then detect new/modified/removed persistence entries. Tags each entry with MITRE ATT&CK technique. Trigger when user asks to check persistence, autorun, startup items, scheduled tasks, registry run keys, WMI subscriptions, or suspects a malware persistence mechanism.

Jump to install

Repository: bj112233/governor-edr
Last source activity: July 23, 2026 at 18:13
Detected SKILL.md language: Hebrew
Stars: 1
Forks: 0

Install options

The review-first prompt is selected by default. You can switch to a direct command or download a local copy.

Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.

A direct command skips the review prompt. Inspect the source before running it.

npx skills add https://github.com/bj112233/governor-edr --skill persistence-hunter

The command stays on one line. Scroll horizontally to inspect it before copying.

Prefer a local copy? Download the files currently available to SkillsMP.

Review the source files

Read SKILL.md and any companion files shown by SkillsMP before deciding whether to install.

File Explorer

6 files

SKILL.md

Source instructions · Read-only preview

Back to search Back to installation

arch-update

Update docs/ARCHITECTURE.md (and conceptual_repo/ARCHITECTURE.md if it references the same facts) after a significant commit, then commit atomically as docs(arch)

2026-07-23

commit

Create a git commit following the project's conventional-commit format, then auto-trigger the arch-update skill for the separate atomic docs(arch) commit when the change is significant. Enforces AGENTS.md §4 (atomic docs commit, never bundled into code).

2026-07-23

lesson

Capture a new lesson in tasks/lessons.md after a user correction or a mistake discovered, following the established entry format

2026-07-23

View all from this repository

name	persistence-hunter
description	Windows persistence mechanism scanner. Scans all autorun vectors: Registry Run/RunOnce keys (T1547.001), Startup folders (T1547.004), Scheduled Tasks (T1053.005), and WMI Event Subscriptions (T1546.003). Filters Microsoft-signed noise by default (reduces ~80 legit entries to only suspicious ones). Supports baseline/diff for change detection — save known-good state, then detect new/modified/removed persistence entries. Tags each entry with MITRE ATT&CK technique. Trigger when user asks to check persistence, autorun, startup items, scheduled tasks, registry run keys, WMI subscriptions, or suspects a malware persistence mechanism.
metadata	{"clawdbot":{"emoji":"🔍","commands":["scan","baseline","diff"],"arg_template":"scripts/persistence_hunter.py {command} {args}","timeout":45,"requires":{"bins":["python"]},"install":[],"commands_schema":{"scan":{"properties":{"include_ms":{"type":"boolean","default":false,"description":"Include Microsoft-signed entries (default: filtered out to reduce noise)"}},"required":[]},"baseline":{"properties":{},"required":[]},"diff":{"properties":{"include_ms":{"type":"boolean","default":false,"description":"Include Microsoft-signed entries in diff comparison"}},"required":[]}}}}