“persistence”的搜索结果

Plan persistence testing for authorized Windows and Linux security exercises, examining how access can survive logons or restarts. The skill compares mechanisms by privilege level and environment, with validation steps, detection indicators, and cleanup considerations.

中文简介正在准备中。当前显示英语简介。

• Planning persistence tests for authorized exercises
• Comparing methods by operating system and privilege
• Reviewing detection indicators for persistence

Find WMI event subscriptions that let attackers retain access to Windows systems. Correlate Sysmon events with stored subscriptions and Autoruns results, inspect execution triggers and commands, and document risks and recommended remediation.

中文简介正在准备中。当前显示英语简介。

• Triaging Sysmon alerts for events 19, 20, and 21
• Finding WMI persistence during incident response
• Distinguishing suspicious subscriptions from legitimate settings

Inspect Linux scheduled tasks, services, shell profiles, shared library settings, and SSH keys for mechanisms that maintain attacker access. Correlate findings with audit logs to produce a timeline, risk scores, and remediation commands.

中文简介正在准备中。当前显示英语简介。

• Investigating how attackers maintained access to a Linux host
• Hunting for suspicious scheduled tasks and services
• Building a timeline from persistence-related audit events

Inspect Windows startup entries with Sysinternals Autoruns to find possible malware persistence, settings that let malware restart automatically. Review signatures, file locations, and changes from a clean baseline to identify entries that need investigation.

中文简介正在准备中。当前显示英语简介。

• Investigating suspicious startup entries on a Windows endpoint
• Comparing startup settings against a clean baseline
• Checking for remaining malware startup entries after cleanup

Support authorized Active Directory assessments of DCSync, which abuses directory replication rights to obtain credential data. Cover replication permission review, Golden Ticket persistence testing, detection validation, and documentation of evidence and remediation recommendations.

中文简介正在准备中。当前显示英语简介。

• Reviewing accounts with directory replication rights
• Testing DCSync risks in an authorized lab
• Validating detection of replication abuse and forged tickets

Investigate malware that survives OS reinstallation by checking UEFI firmware, boot files, and Secure Boot settings. Use chipsec and supporting tools to compare trusted baselines, identify bootkit indicators, and document findings.

中文简介正在准备中。当前显示英语简介。

• Investigating reinfection after OS reinstallation
• Checking unexpected Secure Boot changes
• Comparing firmware against a trusted vendor baseline

Apache Pekko + Scala 3によるCQRS/Event Sourcing実装ガイド。 PersistenceEffectorを用いた集約アクター、ドメインモデルとアクターの分離、 状態遷移の型安全な表現、イベント設計、Protocol Buffersシリアライズ、 ZIOベースのユースケース層、リードモデルアップデータの実装パターンを提供する。 対象言語: Scala 3限定。CQRS/Event Sourcingアーキテクチャが前提の場合のみ使用。 トリガー条件: 「Scala」かつ「CQRS」または「Event Sourcing」または「Pekko」が リクエストに含まれる場合のみ起動。Scala以外の言語やCQRS/ES以外のアーキテクチャでは このスキルを使用してはならない。 トリガー：「PekkoでCQRS/ESを実装したい」「Scalaで集約アクターを書きたい」 「PersistenceEffectorの使い方」「Pekkoのイベントソーシング」 「ScalaでCQRSのコマンド側を実装」「Pekkoで状態遷移を管理」 といったPekko + Scala + CQRS/ES実装リクエストで起動。 非トリガー：「CQRSのトレードオフ」「イベントソーシングとは」「JavaでCQRS」 「GoでEvent Sourcing」「CQRSの概念を教えて」など、Scala/Pekko以外や概念的な質問では 起動してはならない。

中文简介正在准备中。当前显示原文说明。

Hunts for Linux persistence by inspecting cron, systemd units, shell rc files, SSH authorized_keys, and common autostart locations for attacker-added entries. Activates for requests to hunt Linux persistence, audit cron/systemd for backdoors, or find unauthorized autostart and authorized_keys entries.

中文简介正在准备中。当前显示原文说明。

Hunts for Windows persistence across autostart locations: Run keys, services, scheduled tasks, WMI event subscriptions, and startup folders, baselining them to surface anomalous or recently added entries. Activates for requests to hunt persistence, audit autostart extensibility points, or find malware autoruns on Windows.

中文简介正在准备中。当前显示原文说明。

Hunts for malicious WMI permanent event subscription persistence by correlating __EventFilter, CommandLineEventConsumer/ActiveScriptEventConsumer, and FilterToConsumerBinding records from Sysmon Event IDs 19/20/21 or WMI repository exports. Activates for requests to hunt WMI persistence, detect event consumer backdoors, or analyze WMI subscription telemetry.

中文简介正在准备中。当前显示原文说明。

Analyzes UEFI bootkit persistence mechanisms including firmware implants in SPI flash, EFI System Partition (ESP) modifications, Secure Boot bypass techniques, and UEFI variable manipulation. Covers detection of known bootkit families (BlackLotus, LoJax, MosaicRegressor, MoonBounce, CosmicStrand), ESP partition forensic inspection, chipsec-based firmware integrity verification, and Secure Boot configuration auditing. Activates for requests involving UEFI malware analysis, firmware persistence investigation, boot chain integrity verification, or Secure Boot bypass detection.

中文简介正在准备中。当前显示原文说明。

Analyzes UEFI bootkit persistence mechanisms including firmware implants in SPI flash, EFI System Partition (ESP) modifications, Secure Boot bypass techniques, and UEFI variable manipulation. Covers detection of known bootkit families (BlackLotus, LoJax, MosaicRegressor, MoonBounce, CosmicStrand), ESP partition forensic inspection, chipsec-based firmware integrity verification, and Secure Boot configuration auditing. Activates for requests involving UEFI malware analysis, firmware persistence investigation, boot chain integrity verification, or Secure Boot bypass detection.

中文简介正在准备中。当前显示原文说明。

Analyzes UEFI bootkit persistence mechanisms including firmware implants in SPI flash, EFI System Partition (ESP) modifications, Secure Boot bypass techniques, and UEFI variable manipulation. Covers detection of known bootkit families (BlackLotus, LoJax, MosaicRegressor, MoonBounce, CosmicStrand), ESP partition forensic inspection, chipsec-based firmware integrity verification, and Secure Boot configuration auditing. Activates for requests involving UEFI malware analysis, firmware persistence investigation, boot chain integrity verification, or Secure Boot bypass detection.

中文简介正在准备中。当前显示原文说明。

Guide malware cleanup on infected Windows and Linux systems after containment and investigation. Covers removing malicious files and mechanisms that preserve attacker access, rotating credentials, patching entry points, and documenting validation results before recovery.

中文简介正在准备中。当前显示英语简介。

• Cleaning infected systems after containment
• Removing mechanisms that preserve attacker access
• Rotating compromised credentials and fixing entry points

Build detection rules for suspicious Windows scheduled tasks by correlating Sysmon and Windows Security logs. Examine parent processes, file paths, encoded commands, and remote task creation to uncover persistent access and movement between systems.

中文简介正在准备中。当前显示英语简介。

• Investigating suspicious scheduled task creation
• Hunting for tasks that run encoded commands
• Detecting remote task creation across systems

Investigate Windows malware that runs in memory or abuses legitimate system tools. Use logs, registry entries, and memory dumps to trace persistence, identify suspicious activity, and produce detection rules and an analysis report.

中文简介正在准备中。当前显示英语简介。

• Investigating suspicious PowerShell activity
• Checking WMI persistence mechanisms
• Finding malicious code in memory dumps

Build detections for fileless attacks on Windows using process activity, script logs, and endpoint monitoring. Investigate suspicious PowerShell, code injected into running processes, WMI persistence, and registry-based execution with logging guidance and detection query examples.

中文简介正在准备中。当前显示英语简介。

• Building detections for suspicious PowerShell activity
• Hunting for code injection into running processes
• Monitoring WMI persistence and registry-based execution

Analyze Windows Registry files to uncover user activity, installed software, USB connections, and automatic startup entries. Organize these traces into investigation summaries and timelines to help examine suspicious activity and possible malware persistence.

中文简介正在准备中。当前显示英语简介。

• Investigating suspicious automatic startup entries
• Reconstructing user activity around an incident
• Checking USB device connection traces

Examine Linux authentication logs, shell history, SSH keys, scheduled tasks, and system settings to investigate a compromise. Help reconstruct activity, identify ways attackers maintain access, and document suspicious accounts, files, and configuration changes.

中文简介正在准备中。当前显示英语简介。

• Investigating a potentially compromised Linux server
• Finding mechanisms that maintain unauthorized access
• Tracing user activity through logs and command history

Generates SwiftData or CoreData persistence layer with optional iCloud sync. Use when user wants to add local storage, data persistence, or cloud sync.

中文简介正在准备中。当前显示原文说明。

Implement local persistence with SwiftData, Core Data, and secure storage. Use when setting up SwiftData models, Core Data stacks, or local persistence in iOS.

中文简介正在准备中。当前显示原文说明。

OS post-exploitation after a stable host foothold: quiet host recon, host-native persistence (Windows Run/tasks/services/COM/WMI and Linux SSH/cron/systemd/SUID), long-term C2 (Sliver primary, Mythic/Havoc optional), targeted collection and exfil, and engagement cleanup. Does not own AD/cloud/K8s native persistence, Ligolo pivoting, LSASS dumping, or EDR bypass. Operator selects objectives; success is a live callback, verified persistence, delivered loot, or restored host — not generating an unused implant.

中文简介正在准备中。当前显示原文说明。

Hunts for malicious scheduled task persistence by analyzing task registration events (4698) and schtasks process creation for suspicious actions, triggers, and hidden tasks. Activates for requests to hunt scheduled task abuse, detect malicious schtasks usage, or find persistence via the Task Scheduler.

中文简介正在准备中。当前显示原文说明。

Detect malicious scheduled task creation and modification using Sysmon Event IDs 1 (Process Create for schtasks.exe), 11 (File Create for task XML), and Windows Security Event 4698/4702. The analyst correlates task creation with suspicious parent processes, public directory paths, and encoded command arguments to identify persistence and lateral movement via scheduled tasks. Activates for requests involving scheduled task detection, Sysmon persistence hunting, or T1053.005 Scheduled Task/Job analysis.

中文简介正在准备中。当前显示原文说明。