Detects T1547.001 startup folder persistence by monitoring Windows startup directories for suspicious file creation, cross-referencing Autoruns entries, and running a Python watchdog script for real-time filesystem monitoring. Use when hunting for malware or implants that survive reboot via startup-folder placement, or when validating autoruns/EDR findings against known-good startup baselines.
Install
npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill hunting-for-startup-folder-persistencenpx skills add mukul975/Anthropic-Cybersecurity-Skills --skill hunting-for-startup-folder-persistence -a claude-code -gnpx skills add mukul975/Anthropic-Cybersecurity-Skills --skill hunting-for-startup-folder-persistence -a codex -ggemini skills install https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git --path skills/hunting-for-startup-folder-persistencegh skill install mukul975/Anthropic-Cybersecurity-Skills hunting-for-startup-folder-persistencegit clone --depth 1 https://github.com/mukul975/Anthropic-Cybersecurity-Skills /tmp/mukul975__Anthropic-Cybersecurity-Skills
mkdir -p ~/.claude/skills ~/.agents/skills
cp -R /tmp/mukul975__Anthropic-Cybersecurity-Skills/skills/hunting-for-startup-folder-persistence ~/.claude/skills/hunting-for-startup-folder-persistence # Claude Code
cp -R /tmp/mukul975__Anthropic-Cybersecurity-Skills/skills/hunting-for-startup-folder-persistence ~/.agents/skills/hunting-for-startup-folder-persistence # Codex, Cursor, Gemini CLI, Copilot, OpenCode