awesome-malware-persistence - A curated list of awesome malware persistence tool

项目说明

Awesome Malware Persistence ![Awesome]()

> A curated list of awesome malware persistence tools and resources.

Malware persistence consists of techniques that ad use to keep access to systems across restarts, changed credentials, and other interruptions that could cut off their access. Techniques used for persistence include any access, action, or configuration changes that let them maintain their foothold on systems, such as replacing or hijacking legitimate code or adding startup code.

Main article about malware persistence with more context and information.

Contents

* Techniques
* Generic
* Linux
* macOS
* Windows
* Cloud
* Firmware
* Databases
* Persistence Removal
* Generic
* Windows
* Detection Testing
* Generic
* Linux
* macOS
* Windows
* Pre
* macOS
* Collection
* Generic
* Linux
* macOS
* Windows

Techniques

_Persistence techniques and detection._

Generic

* MITRE ATT&CK tactic "TA0003 - Persistence" - Persistence tactic information in the MITRE ATT&CK framework.
* Forensic Artifact repository - A free, community-sourced, machine-readable knowledge base of digital forensic artifacts.
* Sigma rules - Repository of detection rules, co persistence techniques as well. You can even use filters such as --filter tag=attack.persistence or specifically for one technique tag=attack.t1084.

Linux

* Linux Malware Persistence with Cron - Blog post about Linux persistence using cron jobs.
* Linux Persistence Techniques - List of persistence techniques.
* Linux Red Team Persistence Techniques - List of persistence techniques.
* PANIX - Persistence Against *NIX - Features - List of persistence techniques.
* Linux Detection Engineering - A primer on persistence mechanisms - List of Linux persistence mechanisms.
* ebpfkit - Rootkit le eBPF.
* TripleCross - Rootkit le eBPF.
* Linux LKM Persistence - Rootkit le Linux loadable kernel module (LKM).

macOS

* thee's series "Beyond the good ol' LaunchAgents" - List of macOS persistence beyond just the LaunchDaemons or LaunchAgents.
* KnockKnock - A persistence detection tool for macOS to scan for persistence mechanisms on macOS. Specific persistence locations are found in the plugins folder, e.g. LaunchItems or StartupScripts.
* PoisonApple - Learn about macOS persistence techniques by looking at the source code of PoisonApple.
* How malware persists on macOS - List of macOS persistence mechanisms.

Windows

* Hexacorn's blog - Blog series "Beyond good ol' Run key" co a lot of Windows persistence mechanisms.
* Autoruns - You can learn which Windows persistence mechanisms are checked by looking at the output of Autoruns on your own client. Categories and the different locations where things were found are seen in the output. A disassembly of Autoruns lists a subset of the entries which are scanned.
* PowerShell implementation of Autoruns - Another way to find Windows persistence locations is to look at the source code of the PowerShell of Autoruns. Bonus: A history of the covered persistence locations for each Autoruns is found at the end of the module file too, which is so awesome!
* Common malware persistence mechanisms - Different persistence mechanisms for different are described.
* Malware persistence techniques - Good summary of multiple persistence mechanisms, ranging from multiple registry keys to more ad one, like COM hijacking.
* Detecting & Removing an Attacker's WMI Persistence - Blog post about detecting and removing WMI persistence.
* Windows Persistence using WinLogon - Blog post about abusing WinLogon.
* Untangling Kovter's persistence methods - Blog post about Kovter's persistens methos, among others, hiding in registry. Another one is Threat Spotlight: Kovter Malware Fileless Persistence Mechanism.
* Persistence using GlobalFlags in Image File Execution Options – Hidden from Autoruns.exe - Blog post about abusing GlobalFlag for process execution.
* Unco a MyKings With Bootloader Persistence Detection and Response - Blog post about bootloader persistence.
* blog posts about COM/CLSID hijacking
* COM Object hijacking: the discreet way of persistence, 2014
* Persistence – COM Hijacking, 2020
* Abusing COM hijacking in combination with scheduled tasks, 2016
* Hunting for persistence Exchange Server or Outlook - Blog post about Microsoft Exchange ser.
* Borrowing Windows Hello keys for authentication and persistence - Ability to perform single-sign on with the backing cryptographic Windows Hello keys from a user session, without needing the PIN or other information/user presence.

Cloud

* Shadow Linking: The Persistence of SaaS Identity Threat - Abuse of additional identity pro to persist in an en.
* Persisting on Entra ID applications and User Managed Identities with Federated Credentials - Persist on Entra ID applications and User Managed Identities with Federated Credentials.
* AWSDoor: Persistence on AWS - Access persistence tool for AWS. The corresponding article describes the techniques ad can use to hide themsel a cloud en and its AWSDoor implementation to simplify and automate the deployment of persistence techniques in AWS en.

Firmware

* MoonBounce: the dark side of UEFI firmware - An in-depth write up about one particular UEFI bootkit.

Databases

* Database Triggers as Persistence Mechanisms - An in-depth write up about database triggers pro persistence.

Persistence Removal

_Tools and commands for persistence mechanisms removal. Beside the tools mentioned below, use standard OS commands to remove the persistence._

Generic

Windows

* PowerSponse - A incident response tool co commands for cleanup of persistence mechanisms as well.
* Removing Backdoors – Powershell Empire Edition - blog posts handle the removal of WMI implants.
* RegDelNull - Removal of registry keys with null bytes - used e.g. in run keys for e.

Detection Testing

_Tools for testing detections. Use the techniques described in Persistence Techniques to create these files or add the configuration changes by hand to test your detections._

Generic

* Atomic Red Team - A red team attack techniques framework supporting also the MITRE ATT&CK persistence techniques, see e.g. T1044 "File System Permissions Weakness".

Linux

* PANIX - A highly customizable Linux persistence tool. Perform persistence techniques against Linux systems, among others Debian and RHEL.
* Diamorphine - A loadable kernel module (LKM) rootkit for Linux Kernels (x86/x86_64 and ARM64).

macOS

* PoisonApple - Perform persistence techniques on macOS.

Windows

* hasherezade persistence demos - (also non standard) persistence methods used by malware for testing own detection, among others COM hijacking demo is found in the repo.

Pre

_Tools for pre malicious persistence._

macOS

* BlockBlock - A tool which provides continual protection by monitoring persistence locations and protects them accordingly. Similar to KnockKnock but for blocking.

Collection

_Tools for persistence collection._

Generic

* Awesome Forensics - Use the tools from this list which includes awesome free (mostly open source) forensic analysis tools and resources. They help collecting the persistence mechanisms at scale, e.g. by using remote forensics tools.
* osquery - Query persistence mechanisms on clients.
* OSSEC - Use rules and logs from the HIDS to detection configuration changes.

Linux

_There is no dedicated persistence collection tool for Linux I'm aware of. Use some of the tools from #General or standard OS commands for collection. Thanks for contributing links to Linux specific persistence collection tools._

* Linux Security and Monitoring Scripts - Security and monitoring scripts you can use to monitor your Linux installation for security-related events or for an in. Among other finding systemd unit files used for malware persistence.

macOS

* KnockKnock - A tool to unco installed software in order to generically reveal such malware. See GitHub repository too for the source code.
* Dylib Hijack Scanner or DHS - A simple utility that will scan your computer for applications that are either susceptible to dylib hijacking or have been hijacked. See GitHub repository too for the source code.

Windows

* Autoruns - A powerful persistence collection tool on Windows is Autoruns. It collects different categories and persistence information from a li and in
limited ways from offline images. There is a UI and a command line program and the output format can be set to CS can then be imported into your log collection system of choice.
* AutorunsToWinE.ps1 - Instead of using CS and copy these file to the server, you can use the AutorunsToWinE script to convert the Autoruns output to Windows event logs and rely on standard Windows event log forwarding.
* PowerShell Autoruns - A PowerShell of Autoruns.
* PersistenceSniper - Powershell module to hunt for persistence implanted in Windows machines.
* RegRipper - Extracts persistence mechanisms from the registry files directly.
* RECmd - Extract persistence mechanisms, e.g. by using the config file UserClassesASEPs to extract user's CLSID information.
* KAPE - The tool allows collecting predefined artifactgs using targets and modules, see KapeFiles which include persistence mechanisms, among others there's a collection of LNK files, scheduled task files and scheduled task listing or a WMI repository auditing module.
* PyrsistenceSniper - A Python-based offline Windows persistence detection tool. Point it at a KAPE dump, a collection, or a mounted disk image and get offline Windows persistence detection. Runs on Windows, Linux, and macOS.

Contributing

Contributions welcome! Read the contribution guidelines first.

项目信息

开发语言：未知

Star 数：312

技术要点

该项目属于病毒分析方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕A curated list of awesome malware persistence tools and resources. 展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。