New: 98,000+ skills indexed from GitHub repos with 100+ stars · every skill safety-checkedBrowse top skillsTop skills
Esc to closeBrowse all skills
Submit a skillBrowse skills
Submit a skillBrowse skills

Agent skill

Malware Persistence Analysis with Autoruns

by mukul975 in mukul975/Anthropic-Cybersecurity-Skills

Hunts Windows malware persistence with Sysinternals Autoruns, covering run keys, services, scheduled tasks and drivers, with baseline comparison.

Apache-2.0Auto-check passedSecurity

Install Malware Persistence Analysis with Autoruns

skills CLI
$ npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill analyzing-malware-persistence-with-autoruns -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install mukul975/Anthropic-Cybersecurity-Skills analyzing-malware-persistence-with-autoruns --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/analyzing-malware-persistence-with-autoruns .claude/skills/analyzing-malware-persistence-with-autoruns && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
analyzing-malware-persistence-with-autoruns
GitHub stars
34k
Token cost
~1.2k tokens
SKILL.md length
193 words
Files
7 (incl. scripts, references, assets)
Skills in repo
644
Repo updated
First seen
Licence
Apache-2.0

At a glance

Hunts Windows malware persistence with Sysinternals Autoruns, covering run keys, services, scheduled tasks and drivers, with baseline comparison.

  • Hunting for persistence on a Windows machine during incident response
  • SKILL.md covers Overview, When to Use, Prerequisites and Workflow, plus 2 more sections
  • Runs Python scripts from its folder
  • Triaging a possibly compromised endpoint

What it does

Autoruns reads data from hundreds of auto-start extensibility points on Windows, across 18 or more categories that include Run and RunOnce keys, services, scheduled tasks, drivers, Winlogon entries, LSA providers, print monitors, WMI subscriptions and AppInit DLLs. The skill uses that data to find malware persistence during incident response, or to confirm that autostart entries were fully removed.

Signature checks filter out Microsoft-signed entries, a compare function diffs the current state against a clean baseline to reveal newly added persistence, VirusTotal lookups check hash reputation, and the -z flag allows offline examination of a forensic disk image. A Python script, scripts/agent.py, automates the scan, and the skill lists validation criteria such as unsigned entries being flagged and suspicious paths and LOLBin launch strings being highlighted.

It expects Autoruns and Autorunsc, administrative rights on the target, Python 3, a VirusTotal API key and a clean baseline export. Reference files cover the API, standards and workflows, a report template sits in assets, and links point to Microsoft and SANS material and to the MITRE ATT&CK autostart technique.

When your agent uses it

  • Hunting for persistence on a Windows machine during incident response
  • Triaging a possibly compromised endpoint
  • Verifying that malware autostart entries were all found and removed
  • Comparing a suspect system against a clean baseline export

Example prompts

  • “Run an Autoruns scan on this endpoint and flag the unsigned entries.”
  • “Compare today's Autoruns export with the clean baseline and list the new persistence.”
  • “Check these Autoruns file hashes against VirusTotal and highlight anything suspicious.”
  • “Analyze an offline Autoruns capture taken from the forensic image.”

Requirements

  • Sysinternals Autoruns and Autorunsc
  • Administrative privileges on the target Windows system
  • Python 3 for the automated analysis
  • A VirusTotal API key for reputation checks

What it can do on your machine

Read from SKILL.md and the folder at commit 54a7988. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    Ships 1 file in scripts/ (Python), which the agent can run.

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    Links to these hosts (documentation or services it may open):

    • learn.microsoft.com
    • sans.org
    • nasbench.medium.com
    • attack.mitre.org

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Malware Persistence Analysis with Autoruns loads about 1.2k tokens when it runs, and up to ~1.8k if it reads all its reference files. Until then it costs about 105 tokens; SKILL.md has 193 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~105
When it runs · the whole SKILL.md, loaded when a task matches
~1.2k
With references · SKILL.md plus every file in references/, read only if the agent opens them
~1.8k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); the scripts in this folder are not scanned.

SKILL.md

The full file from mukul975/Anthropic-Cybersecurity-Skills at commit 54a7988, republished under its Apache-2.0 licence (© mukul975). 193 words, ~1,172 tokens.

Download SKILL.mdSave it as .claude/skills/analyzing-malware-persistence-with-autoruns/SKILL.md (or your agent's skills folder). This skill also uses 6 other files; get the full folder from GitHub.
name
analyzing-malware-persistence-with-autoruns
description
Use Sysinternals Autoruns to systematically enumerate and analyze malware persistence mechanisms across Windows registry run keys, scheduled tasks, services, drivers, and startup locations. Use when hunting for persistence during Windows incident response, triaging a compromised endpoint, or validating that malware autostart entries have been fully identified and removed.
domain
cybersecurity
subdomain
malware-analysis
tags
autoruns, persistence, malware-analysis, sysinternals, windows, registry, startup, incident-response
mitre_attack
T1547.001, T1543.003, T1053.005, T1574.001, T1037.001
version
1.0
author
mahipal
license
Apache-2.0
d3fend_techniques
Executable Denylisting, Execution Isolation, File Metadata Consistency Validation, Content Format Conversion, File Content Analysis
nist_csf
DE.AE-02, RS.AN-03, ID.RA-01, DE.CM-01

Analyzing Malware Persistence with Autoruns

Overview

Sysinternals Autoruns extracts data from hundreds of Auto-Start Extensibility Points (ASEPs) on Windows, scanning 18+ categories including Run/RunOnce keys, services, scheduled tasks, drivers, Winlogon entries, LSA providers, print monitors, WMI subscriptions, and AppInit DLLs. Digital signature verification filters Microsoft-signed entries. The compare function identifies newly added persistence via baseline diffing. VirusTotal integration checks hash reputation. Offline analysis via -z flag enables forensic disk image examination.

When to Use

  • When investigating security incidents that require analyzing malware persistence with autoruns
  • When building detection rules or threat hunting queries for this domain
  • When SOC analysts need structured procedures for this analysis type
  • When validating security monitoring coverage for related attack techniques

Prerequisites

  • Sysinternals Autoruns (GUI) and Autorunsc (CLI)
  • Administrative privileges on target system
  • Python 3.9+ for automated analysis
  • VirusTotal API key for reputation checks
  • Clean baseline export for comparison

Workflow

Step 1: Automated Persistence Scanning
python
#!/usr/bin/env python3
"""Automate Autoruns-based persistence analysis."""
import subprocess
import csv
import json
import sys


def scan_and_analyze(autorunsc_path="autorunsc64.exe", csv_path="scan.csv"):
    cmd = [autorunsc_path, "-a", "*", "-c", "-h", "-s", "-nobanner", "*"]
    result = subprocess.run(cmd, capture_output=True, text=True, timeout=600)
    with open(csv_path, 'w') as f:
        f.write(result.stdout)
    return parse_and_flag(csv_path)


def parse_and_flag(csv_path):
    suspicious = []
    with open(csv_path, 'r', errors='replace') as f:
        for row in csv.DictReader(f):
            reasons = []
            signer = row.get("Signer", "")
            if not signer or signer == "(Not verified)":
                reasons.append("Unsigned binary")
            if not row.get("Description") and not row.get("Company"):
                reasons.append("Missing metadata")
            path = row.get("Image Path", "").lower()
            for sp in ["\temp\\", "\appdata\local\temp", "\users\public\\"]:
                if sp in path:
                    reasons.append(f"Suspicious path")
            launch = row.get("Launch String", "").lower()
            for kw in ["powershell", "cmd /c", "wscript", "mshta", "regsvr32"]:
                if kw in launch:
                    reasons.append(f"LOLBin: {kw}")
            if reasons:
                row["reasons"] = reasons
                suspicious.append(row)
    return suspicious


if __name__ == "__main__":
    if len(sys.argv) > 1:
        results = parse_and_flag(sys.argv[1])
        print(f"[!] {len(results)} suspicious entries")
        for r in results:
            print(f"  {r.get('Entry','')} - {r.get('Image Path','')}")
            for reason in r.get('reasons', []):
                print(f"    - {reason}")

Validation Criteria

  • All ASEP categories scanned and cataloged
  • Unsigned entries flagged for investigation
  • Suspicious paths and LOLBin launch strings highlighted
  • Baseline comparison identifies new persistence mechanisms

References

© mukul975, Apache-2.0. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

SKILL.md and 6 other files (scripts, references, assets) in skills/analyzing-malware-persistence-with-autoruns of mukul975/Anthropic-Cybersecurity-Skills.

  • SKILL.md
  • LICENSE
  • assets/template.md
  • references/api-reference.md
  • references/standards.md
  • references/workflows.md
  • scripts/agent.py

Open the folder on GitHubat commit 54a7988

Compare with similar skills

Malware Persistence Analysis with Autoruns next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Malware Persistence Analysis with Autoruns compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Malware Persistence Analysis with Autoruns this skillmukul975/Anthropic-Cybersecurity-Skills34k—~1.2kAutomated safety check: PassApache-2.0
Forensics OsqueryAgentSecOps/SecOpsAgentKit2201 repos~4.9kAutomated safety check: NotesCustom licence
Ir VelociraptorAgentSecOps/SecOpsAgentKit2201 repos~3.1kAutomated safety check: PassCustom licence
Incident Response NetworkLeoYeAI/openclaw-master-skills2.2k—~5kAutomated safety check: PassApache-2.0
Incident Responsealirezarezvani/claude-skills28k—~3.8kAutomated safety check: PassMIT
Dfirtransilienceai/communitytools563—~1.5kAutomated safety check: PassMIT

Similar skills

  • Forensics Osquery

    AgentSecOps/SecOpsAgentKit

    SQL-powered forensic investigation and system interrogation using osquery to query operating systems as relational databases.

    220 GitHub starsUsed in 1 repo~4.9k tokens
    SecurityAuto-check: notes

  • Ir Velociraptor

    AgentSecOps/SecOpsAgentKit

    Endpoint visibility, digital forensics, and incident response using Velociraptor Query Language (VQL) for evidence collection and threat hunting at scale.

    220 GitHub starsUsed in 1 repo~3.1k tokens
    SecurityAuto-check passed

  • Incident Response Network

    LeoYeAI/openclaw-master-skills

    Network forensics evidence collection and analysis during security incidents.

    2.2k GitHub stars~5k tokensUpdated 2 mo ago
    SecurityAuto-check passed

  • Incident Response

    alirezarezvani/claude-skills

    A skill your agent uses when a security incident has been detected or declared and needs classification, triage, escalation path determination, and forensic evidence collection.

    28k GitHub stars~3.8k tokensUpdated 1 mo ago
    DevOps & CloudAuto-check passed

  • Dfir

    transilienceai/communitytools

    Digital forensics and incident response - Windows event log analysis, PCAP forensics, filesystem artifact analysis, AD attack detection, and timeline correlation.

    563 GitHub stars~1.5k tokensUpdated 2 mo ago
    SecurityAuto-check passed

  • TShark Traffic Analysis

    AgentSecOps/SecOpsAgentKit

    Guides authorized packet capture and analysis with TShark, Wireshark's command-line tool, for security investigations, malware detection and forensic examination of network traffic.

    220 GitHub starsUsed in 1 repo~4.8k tokens
    SecurityAuto-check: notes

More from mukul975/Anthropic-Cybersecurity-Skills

All 644 skills in this repo

  • Campaign Attribution Evidence Analysis

    mukul975/Anthropic-Cybersecurity-Skills

    Weighs infrastructure, TTP, malware code and timing evidence with the Diamond Model and competing hypotheses to reach a confidence-rated attribution.

    34k GitHub stars~2.3k tokensUpdated 1 mo ago
    Auto-check passed

  • Go Malware Analysis in Ghidra

    mukul975/Anthropic-Cybersecurity-Skills

    Walks through reverse engineering Go-compiled malware in Ghidra: parsing buildinfo and pclntab, recovering stripped function names and extracting dependencies.

    34k GitHub stars~2.8k tokensUpdated 1 mo ago
    Auto-check passed

  • LNK and Jump List Forensics

    mukul975/Anthropic-Cybersecurity-Skills

    Guides forensic analysis of Windows LNK shortcut files and Jump Lists with LECmd, JLECmd and manual parsing to show file access and program execution.

    34k GitHub stars~2.8k tokensUpdated 1 mo ago
    Auto-check passed

  • NTFS MFT Deleted File Recovery

    mukul975/Anthropic-Cybersecurity-Skills

    Guides a Windows forensic examination of the NTFS Master File Table to recover deleted-file evidence, build timelines and spot timestomping.

    34k GitHub stars~2.7k tokensUpdated 1 mo ago
    Auto-check passed

  • Network Covert Channel Analysis

    mukul975/Anthropic-Cybersecurity-Skills

    Detects DNS tunneling, ICMP exfiltration and HTTP-based covert channels in packet captures and DNS logs when hunting for hidden command-and-control traffic.

    34k GitHub stars~2k tokensUpdated 1 mo ago
    Auto-check passed

  • ATT&CK Threat Actor Mapping

    mukul975/Anthropic-Cybersecurity-Skills

    Maps threat actor behavior and observed indicators to MITRE ATT&CK, builds Navigator coverage heatmaps, finds detection gaps and produces threat intelligence reports.

    34k GitHub stars~2.5k tokensUpdated 1 mo ago
    Auto-check passed

Works with

Categories

Questions about Malware Persistence Analysis with Autoruns

What does Malware Persistence Analysis with Autoruns do?

Hunts Windows malware persistence with Sysinternals Autoruns, covering run keys, services, scheduled tasks and drivers, with baseline comparison. Autoruns reads data from hundreds of auto-start extensibility points on Windows, across 18 or more categories that include Run and RunOnce keys, services, scheduled tasks, drivers, Winlogon entries, LSA providers, print monitors, WMI subscriptions and AppInit DLLs. The skill uses that data to find malware persistence during incident response, or to confirm that autostart entries were fully removed.

When should I use Malware Persistence Analysis with Autoruns?

Malware Persistence Analysis with Autoruns fits situations like: hunting for persistence on a Windows machine during incident response; triaging a possibly compromised endpoint; verifying that malware autostart entries were all found and removed; comparing a suspect system against a clean baseline export.

How do I install Malware Persistence Analysis with Autoruns in Claude Code?

Run `npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill analyzing-malware-persistence-with-autoruns -a claude-code`. Or copy the skill folder (skills/analyzing-malware-persistence-with-autoruns in mukul975/Anthropic-Cybersecurity-Skills) into .claude/skills/analyzing-malware-persistence-with-autoruns in your project. Claude Code loads it when a task matches its description.

How do I install Malware Persistence Analysis with Autoruns in Codex?

Run `npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill analyzing-malware-persistence-with-autoruns -a codex`. Or copy the skill folder (skills/analyzing-malware-persistence-with-autoruns in mukul975/Anthropic-Cybersecurity-Skills) into .agents/skills/analyzing-malware-persistence-with-autoruns in your project. Codex loads it when a task matches its description.

Can I use Malware Persistence Analysis with Autoruns in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill analyzing-malware-persistence-with-autoruns -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/analyzing-malware-persistence-with-autoruns, .gemini/skills/analyzing-malware-persistence-with-autoruns, .github/skills/analyzing-malware-persistence-with-autoruns and .opencode/skills/analyzing-malware-persistence-with-autoruns in your project.

What does Malware Persistence Analysis with Autoruns need to run?

Going by SKILL.md and its folder, Malware Persistence Analysis with Autoruns needs Python for the scripts in its folder. Our summary lists: Sysinternals Autoruns and Autorunsc; Administrative privileges on the target Windows system; Python 3 for the automated analysis; A VirusTotal API key for reputation checks.

Does Malware Persistence Analysis with Autoruns access the network?

SKILL.md names 4 domains. As links in the text: learn.microsoft.com, sans.org, nasbench.medium.com and attack.mitre.org. This is read from the text; nothing was executed.

Is Malware Persistence Analysis with Autoruns safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. The check reads SKILL.md only: the scripts in the folder are not scanned, so read them before running anything.

What licence does Malware Persistence Analysis with Autoruns use?

Malware Persistence Analysis with Autoruns is published under the Apache-2.0 licence (declared in SKILL.md). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Malware Persistence Analysis with Autoruns use?

About 1.2k tokens (SKILL.md is roughly 4.7k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full. Its references folder adds about 655 tokens, read only when the agent opens those files.

What are the alternatives to Malware Persistence Analysis with Autoruns?

Skills that share tags, products or a category with Malware Persistence Analysis with Autoruns: Forensics Osquery (AgentSecOps/SecOpsAgentKit, 220 stars), Ir Velociraptor (AgentSecOps/SecOpsAgentKit, 220 stars), Incident Response Network (LeoYeAI/openclaw-master-skills, 2.2k stars) and Incident Response (alirezarezvani/claude-skills, 28k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Malware Persistence Analysis with Autoruns?

mukul975 (a GitHub user) maintains it in mukul975/Anthropic-Cybersecurity-Skills, which has 34,116 GitHub stars. The repository holds 644 skills in this directory. The repository was last updated on August 31, 2026.

Source: mukul975/Anthropic-Cybersecurity-Skills on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.