Systematically hunts for adversary persistence mechanisms across Windows endpoints, covering registry Run/RunOnce keys, services, startup folders, scheduled tasks, and WMI event subscriptions. Use when performing a broad persistence sweep during incident response or building SIEM detections that cover the full range of Windows persistence techniques (MITRE T1547).
Install
npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill hunting-for-persistence-mechanisms-in-windowsnpx skills add mukul975/Anthropic-Cybersecurity-Skills --skill hunting-for-persistence-mechanisms-in-windows -a claude-code -gnpx skills add mukul975/Anthropic-Cybersecurity-Skills --skill hunting-for-persistence-mechanisms-in-windows -a codex -ggemini skills install https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git --path skills/hunting-for-persistence-mechanisms-in-windowsgh skill install mukul975/Anthropic-Cybersecurity-Skills hunting-for-persistence-mechanisms-in-windowsgit clone --depth 1 https://github.com/mukul975/Anthropic-Cybersecurity-Skills /tmp/mukul975__Anthropic-Cybersecurity-Skills
mkdir -p ~/.claude/skills ~/.agents/skills
cp -R /tmp/mukul975__Anthropic-Cybersecurity-Skills/skills/hunting-for-persistence-mechanisms-in-windows ~/.claude/skills/hunting-for-persistence-mechanisms-in-windows # Claude Code
cp -R /tmp/mukul975__Anthropic-Cybersecurity-Skills/skills/hunting-for-persistence-mechanisms-in-windows ~/.agents/skills/hunting-for-persistence-mechanisms-in-windows # Codex, Cursor, Gemini CLI, Copilot, OpenCode