Performing Malware Persistence Investigation

When to Use

• When investigating how malware maintains presence on a compromised system after reboots
• During incident response to identify all persistence mechanisms for complete remediation
• For threat hunting to discover unauthorized autostart entries across endpoints
• When analyzing malware behavior to understand its persistence strategy
• For verifying that all persistence has been removed after incident remediation

Prerequisites

• Forensic image or live system access with administrative privileges
• Autoruns (Sysinternals) for Windows persistence enumeration
• RegRipper for offline registry analysis
• Understanding of Windows and Linux persistence mechanisms
• YARA rules for scanning persistence locations
• Baseline of known-good autorun entries for comparison

Workflow