performing-malware-persistence-investigation

name	performing-malware-persistence-investigation
description	Systematically investigate all persistence mechanisms on Windows and Linux systems to identify how malware survives reboots and maintains access.
domain	cybersecurity
subdomain	digital-forensics
tags	["forensics","malware-persistence","autoruns","registry","scheduled-tasks","rootkit-detection","incident-response"]
mitre_attack	["T1547.001","T1053.005","T1543.003","T1546.003","T1574"]
version	1.0
author	mahipal
license	Apache-2.0
nist_csf	["RS.AN-01","RS.AN-03","DE.AE-02","RS.MA-01"]

Performing Malware Persistence Investigation

When to Use

• When investigating how malware maintains presence on a compromised system after reboots
• During incident response to identify all persistence mechanisms for complete remediation
• For threat hunting to discover unauthorized autostart entries across endpoints
• When analyzing malware behavior to understand its persistence strategy
• For verifying that all persistence has been removed after incident remediation

Prerequisites

• Forensic image or live system access with administrative privileges
• Autoruns (Sysinternals) for Windows persistence enumeration
• RegRipper for offline registry analysis
• Understanding of Windows and Linux persistence mechanisms
• YARA rules for scanning persistence locations
• Baseline of known-good autorun entries for comparison

Workflow

Step 1: Enumerate Windows Registry Persistence

# Extract registry hives from forensic image
mount -o ro,loop,offset=$((2048*512)) /cases/case-2024-001/images/evidence.dd /mnt/evidence

# Key registry persistence locations
python3 << 'PYEOF'
from Registry import Registry
import json

results = {'registry_persistence': []}

# SYSTEM hive analysis
system_reg = Registry.Registry("/cases/case-2024-001/registry/SYSTEM")
select = system_reg.open("Select")
current = select.value("Current").value()
cs = f"ControlSet{current:03d}"

# Services (very common persistence)
services = system_reg.open(f"{cs}\\Services")
for svc in services.subkeys():
    try:
        start_type = svc.value("Start").value()
        image_path = ""
        try:
            image_path = svc.value("ImagePath").value()
        except:
            pass
        # Start types: 0=Boot, 1=System, 2=Auto, 3=Manual, 4=Disabled
        if start_type in (0, 1, 2) and image_path:
            svc_type = svc.value().value()  svc.values()  0
            results[].append({
                : f,
                : ,
                : image_path,
                : start_type,
                : str(svc.timestamp())
            })
    except Exception:
        pass


sw_reg = Registry.Registry()


run_keys = [
    ,
    ,
    ,
    ,
    ,
    ,
    ,
]

 key_path  run_keys:
    try:
        key = sw_reg.open(key_path)
         value  key.values():
            results[].append({
                : f,
                : ,
                : value.name(),
                : str(value.value()),
                : str(key.timestamp())
            })
    except Exception:
        pass


import glob
 ntuser  glob.glob():
    try:
        user_reg = Registry.Registry(ntuser)
        user_run_keys = [
            ,
            ,
            ,
        ]
         key_path  user_run_keys:
            try:
                key = user_reg.open(key_path)
                 value  key.values():
                    results[].append({
                        : f,
                        : ,
                        : value.name(),
                        : str(value.value()),
                        : str(key.timestamp()),
                        : ntuser
                    })
            except Exception:
                pass
    except Exception:
        pass

(f)
 entry  results[]:
    (f)

with open(, ) as f:
    json.dump(results, f, indent=2)
PYEOF