awesome-malware-persistence

MITRE ATT&CK tactic "TA0003 - Persistence"

forensic artifact repository

Forensic artifact repository covers persistence techniques in their artifacts

Sigma rules

Sigma rules which covers persistence techniques. You can even use filters such as or specifically for one technique

Blog post about linux persistence using cron jobs

List of persistence techniques

List of persistence techniques

PANIX - Persistence Against *NIX - Features

List of persistence techniques

List of Linux persistence mechanisms

ebpfkit

Rootkit leveraging eBPF

TripleCross

Rootkit leveraging eBPF

Rootkit leveraging Linux loadable kernel module (LKM)

List of macOS persistence beyond just the LaunchDaemons or LaunchAgents

KnockKnock

A persistence detection tool for macOS to scan for persistence mechanisms on macOS. Specific persistence locations are found in the folder, e.g. or

PoisonApple

Learn about various macOS persistence techniques by looking at the source code of PoisonApple

List of macOS persistence mechanisms

Hexacorn's blog category for persistence category including the series "Beyond good ol' Run key"

You can learn which Windows persistence mechanisms are checked by looking at the output of Autoruns on your own client. Categories and the different locations where things were found are seen in the output. A disassembly of Autoruns lists a subset of the entries which are scanned

PowerShell implementation of Autoruns

Another way to find Windows persistence locations is to look at the source code of the PowerShell version of Autoruns. Bonus: A history of the covered persistence locations for each Autoruns version is found at the end of the module file too, which is so awesome!

Different persistence mechanisms for different vectors are described

Good summary of multiple persistence mechanisms, ranging from multiple registry keys to more advanced one, like COM hijacking

Blog post about detecting and removing WMI persistence

Blog post about abusing WinLogon

Blog post about Kovter's persistens methos, among others, hiding in registry. Another one is

Blog post about abusing GlobalFlag for process execution

Blog post about bootloader persistence

Blog post about Microsoft Exchange server persistence

Abuse of additional identity providers to persist in an environment

Persist on Entra ID applications and User Managed Identities with Federated Credentials

An in-depth write up about one particular UEFI bootkit

Awesome Incident Response

Use the tools and resources for security incident response, aimed to help security analysts and DFIR teams

PowerSponse

PowerSponse includes various commands for cleanup of persistence mechanisms

Various blog posts handle the removal of WMI implants

Removal of registry keys with null bytes - used e.g. in run keys for evasion

Atomic Red Team

Atomic Red Team supports also the MITRE ATT&CK persistence techniques, see e.g.

PANIX

A highly customizable Linux persistence tool. Perform various persistence techniques against Linux systems, among others Debian and RHEL

Diamorphine

A loadable kernel module (LKM) rootkit for Linux Kernels (x86/x86_64 and ARM64)

PoisonApple

Perform various persistence techniques on macOS

hasherezade persistence demos

Various (also non standard) persistence methods used by malware for testing own detection, among others COM hijacking demo is found in the repo

BlockBlock

A tool which provides continual protection by monitoring persistence locations and protects them accordingly. Similar to KnockKnock but for blocking

Awesome Forensics

Use the tools from this list which includes awesome free (mostly open source) forensic analysis tools and resources. They help collecting the persistence mechanisms at scale, e.g. by using remote forensics tools

Query persistence mechanisms on clients

OSSEC

Use rules and logs from the HIDS to detection configuration changes

Linux Security and Monitoring Scripts

Security and monitoring scripts you can use to monitor your Linux installation for security-related events or for an investigation. Among other finding systemd unit files used for malware persistence

A tool to uncover persistently installed software in order to generically reveal such malware. See

A simple utility that will scan your computer for applications that are either susceptible to dylib hijacking or have been hijacked. See

A powerful persistence collection tool on Windows is Autoruns. It collects different categories and persistence information from a live system and . There is a UI and a command line program and the output format can be set to CSV which can then be imported into your log collection system of choice

AutorunsToWinEventLog.ps1

Instead of using CSV output and copy these file to the server, you can use the AutorunsToWinEventLog script to convert the Autoruns output to Windows event logs and rely on standard Windows event log forwarding

PowerShell Autoruns

A PowerShell version of Autoruns

PersistenceSniper

Powershell module to hunt for persistence implanted in Windows machines

Extracts various persistence mechanisms from the registry files directly

RECmd

Extract various persistence mechanisms, e.g. by using the config file to extract user's CLSID information

The tool allows collecting various predefined artifactgs using targets and modules, see which include persistence mechanisms, among others there's a collection of , and or a module