performing-malware-persistence-investigation

name	performing-malware-persistence-investigation
description	Systematically investigate all persistence mechanisms on Windows and Linux systems to identify how malware survives reboots and maintains access. Use when working with performing malware persistence investigation.
domain	cybersecurity
tags	["forensics","malware-persistence","autoruns","registry","scheduled-tasks","rootkit-detection","incident-response"]
subdomain	digital-forensics
mitre_attack	["T1547.001","T1053.005","T1543.003","T1546.003","T1574"]
version	1.0
author	oyi77
license	Apache-2.0
nist_csf	["RS.AN-01","RS.AN-03","DE.AE-02","RS.MA-01"]

Performing Malware Persistence Investigation

Overview

Cybersecurity skill for performing malware persistence investigation. Follows industry best practices and security standards.

When to Use

Trigger phrases:

• "performing malware persistence investigation"

• "Systematically investigate all persistence mechanisms on Windows and Linux syste"

• When investigating how malware maintains presence on a compromised system after reboots

• During incident response to identify all persistence mechanisms for complete remediation

• For threat hunting to discover unauthorized autostart entries across endpoints

• When analyzing malware behavior to understand its persistence strategy

• For verifying that all persistence has been removed after incident remediation

When NOT to Use

• When you lack proper authorization for testing
• For production systems without change management
• When the task requires legal or compliance expertise beyond technical scope

Prerequisites

• Forensic image or live system access with administrative privileges
• Autoruns (Sysinternals) for Windows persistence enumeration
• RegRipper for offline registry analysis
• Understanding of Windows and Linux persistence mechanisms
• YARA rules for scanning persistence locations
• Baseline of known-good autorun entries for comparison

Workflow

# Example: IOC detection
import re

IOC_PATTERNS = {
    "ip": r"\b(?:\d{1,3}\.){3}\d{1,3}\b",
    "domain": r"\b[a-z0-9-]+\.[a-z]{2,}\b",
    "hash_md5": r"\b[a-f0-9]{32}\b",
    "hash_sha256": r"\b[a-f0-9]{64}\b",
}

def extract_iocs(text: str) -> dict:
    return {k: re.findall(v, text) for k, v in IOC_PATTERNS.items()}