persistence-hunter

Windows persistence mechanism scanner. Scans all autorun vectors: Registry Run/RunOnce keys (T1547.001), Startup folders (T1547.004), Scheduled Tasks (T1053.005), and WMI Event Subscriptions (T1546.003). Filters Microsoft-signed noise by default (reduces ~80 legit entries to only suspicious ones). Supports baseline/diff for change detection — save known-good state, then detect new/modified/removed persistence entries. Tags each entry with MITRE ATT&CK technique. Trigger when user asks to check persistence, autorun, startup items, scheduled tasks, registry run keys, WMI subscriptions, or suspects a malware persistence mechanism.

跳到安装

仓库: bj112233/governor-edr
最近来源活动: 2026年7月23日 18:13
检测到的 SKILL.md 语言: 希伯来语
星标: 1
分支: 0

安装方式

默认使用会先检查来源的 Prompt；你也可以切换为直接命令，或下载本地副本。

用 Codex 或 Claude 帮你安装复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。

直接命令不会经过审查 Prompt；运行前请先检查来源。

npx skills add https://github.com/bj112233/governor-edr --skill persistence-hunter

命令会保持在同一行。复制前请横向滚动并检查完整内容。

想先保存到本地？可下载 SkillsMP 当前能够提供的文件。

检查来源文件

决定是否安装前，请先阅读 SKILL.md，以及 SkillsMP 当前展示的配套文件。

文件资源管理器

6 个文件

SKILL.md

来源说明 · 只读预览

返回搜索返回安装

arch-update

Update docs/ARCHITECTURE.md (and conceptual_repo/ARCHITECTURE.md if it references the same facts) after a significant commit, then commit atomically as docs(arch)

2026-07-23

commit

Create a git commit following the project's conventional-commit format, then auto-trigger the arch-update skill for the separate atomic docs(arch) commit when the change is significant. Enforces AGENTS.md §4 (atomic docs commit, never bundled into code).

2026-07-23

lesson

Capture a new lesson in tasks/lessons.md after a user correction or a mistake discovered, following the established entry format

2026-07-23

查看这个仓库的全部 Skills

name	persistence-hunter
description	Windows persistence mechanism scanner. Scans all autorun vectors: Registry Run/RunOnce keys (T1547.001), Startup folders (T1547.004), Scheduled Tasks (T1053.005), and WMI Event Subscriptions (T1546.003). Filters Microsoft-signed noise by default (reduces ~80 legit entries to only suspicious ones). Supports baseline/diff for change detection — save known-good state, then detect new/modified/removed persistence entries. Tags each entry with MITRE ATT&CK technique. Trigger when user asks to check persistence, autorun, startup items, scheduled tasks, registry run keys, WMI subscriptions, or suspects a malware persistence mechanism.
metadata	{"clawdbot":{"emoji":"🔍","commands":["scan","baseline","diff"],"arg_template":"scripts/persistence_hunter.py {command} {args}","timeout":45,"requires":{"bins":["python"]},"install":[],"commands_schema":{"scan":{"properties":{"include_ms":{"type":"boolean","default":false,"description":"Include Microsoft-signed entries (default: filtered out to reduce noise)"}},"required":[]},"baseline":{"properties":{},"required":[]},"diff":{"properties":{"include_ms":{"type":"boolean","default":false,"description":"Include Microsoft-signed entries in diff comparison"}},"required":[]}}}}