Hunts for registry-based persistence mechanisms (MITRE T1547) in Windows environments, including Run/RunOnce keys, Winlogon Shell/Userinit modifications, Image File Execution Options (IFEO) debugger injection, and COM hijacking via CLSID overrides. Use when auditing the registry for persistence artifacts or building detections for registry-based malware autostart techniques.
安装
npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill hunting-for-registry-persistence-mechanismsnpx skills add mukul975/Anthropic-Cybersecurity-Skills --skill hunting-for-registry-persistence-mechanisms -a claude-code -gnpx skills add mukul975/Anthropic-Cybersecurity-Skills --skill hunting-for-registry-persistence-mechanisms -a codex -ggemini skills install https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git --path skills/hunting-for-registry-persistence-mechanismsgh skill install mukul975/Anthropic-Cybersecurity-Skills hunting-for-registry-persistence-mechanismsgit clone --depth 1 https://github.com/mukul975/Anthropic-Cybersecurity-Skills /tmp/mukul975__Anthropic-Cybersecurity-Skills
mkdir -p ~/.claude/skills ~/.agents/skills
cp -R /tmp/mukul975__Anthropic-Cybersecurity-Skills/skills/hunting-for-registry-persistence-mechanisms ~/.claude/skills/hunting-for-registry-persistence-mechanisms # Claude Code
cp -R /tmp/mukul975__Anthropic-Cybersecurity-Skills/skills/hunting-for-registry-persistence-mechanisms ~/.agents/skills/hunting-for-registry-persistence-mechanisms # Codex, Cursor, Gemini CLI, Copilot, OpenCode