awesome-malware-persistence

Persistence tools

A curated collection of malware persistence techniques and tools to help detect and understand malicious activity.

A curated list of awesome malware persistence tools and resources.

GitHub

189 stars
4 watching
12 forks
last commit: almost 2 years ago
Linked from 2 awesome lists

awesomeawesome-listmalwaremalware-analysismalware-detectionmalware-persistencepersistencethreat-huntingthreat-intelligence

Awesome Malware Persistence / Techniques / Generic

MITRE ATT&CK tactic "TA0003 - Persistence"MITRE ATT&CK tactic "TA0003 - Persistence"
forensic artifact repository1,071about 2 years agoForensic artifact repository covers persistence techniques in their artifacts
Sigma rules8,490almost 2 years agoSigma rules which covers persistence techniques. You can even use filters such as or specifically for one technique

Awesome Malware Persistence / Techniques / Linux

Linux Malware Persistence with CronBlog post about linux persistence using cron jobs
Linux Persistence TechniquesList of persistence techniques
Linux Red Team Persistence TechniquesList of persistence techniques
PANIX - Persistence Against *NIX - Features465almost 2 years agoList of persistence techniques
Linux Detection Engineering - A primer on persistence mechanismsList of Linux persistence mechanisms
ebpfkit766over 3 years agoRootkit leveraging eBPF
TripleCross1,796over 2 years agoRootkit leveraging eBPF
Linux LKM PersistenceRootkit leveraging Linux loadable kernel module (LKM)

Awesome Malware Persistence / Techniques / macOS

theevilbit's series "Beyond the good ol' LaunchAgents"List of macOS persistence beyond just the LaunchDaemons or LaunchAgents
KnockKnock473almost 2 years agoA persistence detection tool for macOS to scan for persistence mechanisms on macOS. Specific persistence locations are found in the folder, e.g. or
PoisonApple221over 4 years agoLearn about various macOS persistence techniques by looking at the source code of PoisonApple
How malware persists on macOSList of macOS persistence mechanisms

Awesome Malware Persistence / Techniques / Windows

Hexacorn's blogHexacorn's blog category for persistence category including the series "Beyond good ol' Run key"
AutorunsYou can learn which Windows persistence mechanisms are checked by looking at the output of Autoruns on your own client. Categories and the different locations where things were found are seen in the output. A disassembly of Autoruns lists a subset of the entries which are scanned
PowerShell implementation of Autoruns258over 2 years agoAnother way to find Windows persistence locations is to look at the source code of the PowerShell version of Autoruns. Bonus: A history of the covered persistence locations for each Autoruns version is found at the end of the module file too, which is so awesome!
Common malware persistence mechanismsDifferent persistence mechanisms for different vectors are described
Malware persistence techniquesGood summary of multiple persistence mechanisms, ranging from multiple registry keys to more advanced one, like COM hijacking
Detecting & Removing an Attacker's WMI PersistenceBlog post about detecting and removing WMI persistence
Windows Persistence using WinLogonBlog post about abusing WinLogon
Untangling Kovter's persistence methodsBlog post about Kovter's persistens methos, among others, hiding in registry. Another one is
Persistence using GlobalFlags in Image File Execution Options – Hidden from Autoruns.exeBlog post about abusing GlobalFlag for process execution
Uncovering a MyKings Variant With Bootloader Persistence via Managed Detection and ResponseBlog post about bootloader persistence

Awesome Malware Persistence / Techniques / Windows / Various blog posts about COM/CLSID hijacking

COM Object hijacking: the discreet way of persistence, 2014
Persistence – COM Hijacking, 2020
Abusing COM hijacking in combination with scheduled tasks, 2016

Awesome Malware Persistence / Techniques / Windows

Hunting for persistence via Microsoft Exchange Server or OutlookBlog post about Microsoft Exchange server persistence

Awesome Malware Persistence / Techniques / Cloud

Shadow Linking: The Persistence Vector of SaaS Identity ThreatAbuse of additional identity providers to persist in an environment
Persisting on Entra ID applications and User Managed Identities with Federated CredentialsPersist on Entra ID applications and User Managed Identities with Federated Credentials

Awesome Malware Persistence / Techniques / Firmware

MoonBounce: the dark side of UEFI firmwareAn in-depth write up about one particular UEFI bootkit

Awesome Malware Persistence / Persistence Removal / Generic

Awesome Incident Response7,728about 2 years agoUse the tools and resources for security incident response, aimed to help security analysts and DFIR teams

Awesome Malware Persistence / Persistence Removal / Windows

PowerSponse38over 4 years agoPowerSponse includes various commands for cleanup of persistence mechanisms
Removing Backdoors – Powershell Empire EditionVarious blog posts handle the removal of WMI implants
RegDelNullRemoval of registry keys with null bytes - used e.g. in run keys for evasion

Awesome Malware Persistence / Detection Testing / Generic

Atomic Red Team9,951almost 2 years agoAtomic Red Team supports also the MITRE ATT&CK persistence techniques, see e.g.

Awesome Malware Persistence / Detection Testing / Linux

PANIX465almost 2 years agoA highly customizable Linux persistence tool. Perform various persistence techniques against Linux systems, among others Debian and RHEL
Diamorphine1,865almost 3 years agoA loadable kernel module (LKM) rootkit for Linux Kernels (x86/x86_64 and ARM64)

Awesome Malware Persistence / Detection Testing / macOS

PoisonApple221over 4 years agoPerform various persistence techniques on macOS

Awesome Malware Persistence / Detection Testing / Windows

hasherezade persistence demos219over 3 years agoVarious (also non standard) persistence methods used by malware for testing own detection, among others COM hijacking demo is found in the repo

Awesome Malware Persistence / Prevention / macOS

BlockBlock650about 2 years agoA tool which provides continual protection by monitoring persistence locations and protects them accordingly. Similar to KnockKnock but for blocking

Awesome Malware Persistence / Collection / Generic

Awesome Forensics4,030almost 2 years agoUse the tools from this list which includes awesome free (mostly open source) forensic analysis tools and resources. They help collecting the persistence mechanisms at scale, e.g. by using remote forensics tools
osqueryQuery persistence mechanisms on clients
OSSEC4,533over 2 years agoUse rules and logs from the HIDS to detection configuration changes

Awesome Malware Persistence / Collection / Linux

Linux Security and Monitoring Scripts318almost 2 years agoSecurity and monitoring scripts you can use to monitor your Linux installation for security-related events or for an investigation. Among other finding systemd unit files used for malware persistence

Awesome Malware Persistence / Collection / macOS

KnockKnockA tool to uncover persistently installed software in order to generically reveal such malware. See
Dylib Hijack Scanner or DHSA simple utility that will scan your computer for applications that are either susceptible to dylib hijacking or have been hijacked. See

Awesome Malware Persistence / Collection / Windows

AutorunsA powerful persistence collection tool on Windows is Autoruns. It collects different categories and persistence information from a live system and . There is a UI and a command line program and the output format can be set to CSV which can then be imported into your log collection system of choice
AutorunsToWinEventLog.ps11,231about 2 years agoInstead of using CSV output and copy these file to the server, you can use the AutorunsToWinEventLog script to convert the Autoruns output to Windows event logs and rely on standard Windows event log forwarding
PowerShell Autoruns258over 2 years agoA PowerShell version of Autoruns
PersistenceSniper1,930almost 2 years agoPowershell module to hunt for persistence implanted in Windows machines
RegRipperExtracts various persistence mechanisms from the registry files directly
RECmd134almost 2 years agoExtract various persistence mechanisms, e.g. by using the config file to extract user's CLSID information
KAPEThe tool allows collecting various predefined artifactgs using targets and modules, see which include persistence mechanisms, among others there's a collection of , and or a module

Backlinks from these awesome lists:

More related projects: