Windows Persistence Analyzer

Manual triage of Windows persistence is a slow, error-prone grind through thousands of legitimate autostart entries. This skill automates the identification of malicious persistence mechanisms by analyzing CSV exports from tools like Sysinternals Autoruns or custom incident response collectors.

What it does

• Persistence scoring ranks entries by suspicion based on signatures, paths, and launch arguments.
• Anomaly detection identifies unsigned or invalid binaries located in user-writable paths like AppData or Temp.
• LOLBin analysis flags script hosts, encoded PowerShell, and masquerading process names used for execution.
• Fleet-wide stacking compares data across multiple hosts to surface rare, unique entries that indicate targeted infection.
• Heuristic filtering isolates IFEO debuggers, Winlogon hijacks, AppInit_DLLs, and WMI event consumers.

How it works

1. Import data by providing a Sysinternals autorunsc CSV or a directory of triage collection folders.
2. Apply scoring to evaluate entries against known persistence patterns and suspicious indicators.
3. Execute stacking when analyzing multiple machines to find outliers across the environment.
4. Export findings to JSON or console tables for immediate investigation or further enrichment.

Frameworks & tools

The skill processes output from Sysinternals Autoruns and the incident-response-kit collector. It is designed to work with standard CSV and JSON data structures for forensic analysis.

Why this beats prompting it yourself

Generic LLM prompts struggle with the high volume of noisy, legitimate Microsoft entries. This skill uses specific forensic heuristics and stacking logic to filter thousands of rows, ensuring you don't miss hidden COM hijacks or WMI consumers.

Use cases

• Auditing a suspected compromised workstation for persistence.
• Hunting for rare anomalies across an entire server fleet.
• Triaging large IR collector outputs during an active incident.
• Validating the legitimacy of unknown scheduled tasks and services.

Known limitations

Requires specific CSV headers from autorunsc or incident-response-kit. It does not perform live collection and requires pre-existing forensic exports.