awesome-malware-persistence

You can learn which Windows persistence mechanisms are checked by looking at the output of Autoruns on your own client. Categories and the different locations where things were found are seen in the output. A disassembly of Autoruns lists a subset of the entries which are scanned.

Access persistence tool for AWS. The

Different persistence mechanisms for different vectors are described.

An in-depth write up about database triggers providing persistence.

A red team attack techniques framework supporting also the MITRE ATT&CK persistence techniques, see e.g.

A loadable kernel module (LKM) rootkit for Linux Kernels (x86/x86_64 and ARM64).

Various (also non standard) persistence methods used by malware for testing own detection, among others COM hijacking demo is found in the repo.

A highly customizable Linux persistence tool. Perform various persistence techniques against Linux systems, among others Debian and RHEL.

Perform various persistence techniques on macOS.

A powerful persistence collection tool on Windows is Autoruns. It collects different categories and persistence information from a live system and

Instead of using CSV output and copy these file to the server, you can use the AutorunsToWinEventLog script to convert the Autoruns output to Windows event logs and rely on standard Windows event log forwarding.

Use the tools from this list which includes awesome free (mostly open source) forensic analysis tools and resources. They help collecting the persistence mechanisms at scale, e.g. by using remote forensics tools.

A simple utility that will scan your computer for applications that are either susceptible to dylib hijacking or have been hijacked. See

The tool allows collecting various predefined artifactgs using targets and modules, see

A tool to uncover persistently installed software in order to generically reveal such malware. See

Use the tools and resources for security incident response, aimed to help security analysts and DFIR teams.

A incident response tool covering various commands for cleanup of persistence mechanisms as well.

Removal of registry keys with null bytes - used e.g. in run keys for evasion.

Various blog posts handle the removal of WMI implants.

A tool which provides continual protection by monitoring persistence locations and protects them accordingly. Similar to KnockKnock but for blocking.