PersistenceSniper

Author(s)

• Federico @last0x00 Lagrasta

Tags

Windows Persistence Detection Blue Team

Functions

Find-AllPersistence New-PersistenceObject Get-RunAndRunOnce Get-ImageFileExecutionOptions Get-NLDPDllOverridePath Get-AeDebug Get-WerFaultHangs Get-CmdAutoRun Get-ExplorerLoad Get-WinlogonUserinit Get-WinlogonShell Get-TerminalProfileStartOnUserLogin Get-AppCertDlls Get-AppPaths Get-ServiceDlls Get-GPExtensionDlls Get-WinlogonMPNotify Get-CHMHelperDll Get-HHCtrlHijacking Get-StartupPrograms Get-UserInitMprScript Get-AutodialDLL Get-LsaExtensions Get-ServerLevelPluginDll Get-LsaPasswordFilter Get-LsaAuthenticationPackages Get-LsaSecurityPackages Get-WinlogonNotificationPackages Get-ExplorerTools Get-DotNetDebugger Get-ErrorHandlerCmd Get-WMIEventsSubscrition

Dependencies

This script has no dependencies.

Release Notes

This is still a beta. Only a subset of all the currently known persistence techniques has been implemented so far.