Persistence Techniques Cookbook (Windows)
$29.99
Windows Persistence Cookbook — 10 Techniques, MITRE-Mapped
Ten classic Windows persistence techniques in one Python tool with install/check/remove for each and honest documentation of detection and limitations.
- Registry Run Keys (T1547.001) — HKCU/HKLM Run and RunOnce.
- Scheduled Tasks (T1053.005) — schtasks and ITaskService; logon, idle and time triggers.
- WMI Event Subscriptions (T1546.003) — __EventFilter + CommandLineEventConsumer; survives reboots.
- COM Hijacking (T1546.015) — HKCU CLSID takeover loaded by legitimate apps.
- DLL Search Order Hijacking (T1574.001) — malicious DLL in the application directory.
- Startup Folder (T1547.001) — shell:startup shortcut.
- Windows Services (T1543.003) — v1.1 now quotes the binPath (paths with spaces previously broke sc create).
- AppInit_DLLs (T1546.010) — documented honestly: requires Secure Boot OFF and does not affect protected/UWP processes on Windows 8+.
- Image File Execution Options (T1546.012) — Debugger key redirection.
- Screensaver Abuse (T1546.002) — SCRNSAVE.EXE payload.
Usage: persistence_cookbook.py -t <technique> -p <payload> --install/--check/--remove; --deploy-all with --json output; safe review mode on non-Windows hosts.
Key Features
- 10 classic persistence techniques with install/check/remove for each
- Registry Run Keys, Scheduled Tasks, WMI Event Subscriptions, COM Hijacking, DLL Search Order Hijacking, Startup Folder, Windows Services, AppInit_DLLs, IFEO, Screensaver
- MITRE ATT&CK IDs and detection guidance per technique
- Honest limitations documented (AppInit_DLLs needs Secure Boot off; service payloads must be service-aware)
- JSON output for automation
- Review mode on non-Windows hosts (safe listing without touching the registry)
Requirements
- Windows 7+ with Python 3.8+
- Administrator for HKLM/WMI/services/AppInit/IFEO techniques
Changelog
- 1.1 (2026-10-19): quoted sc create binPath, honest AppInit_DLLs documentation, full review of all 10 techniques
- 1.0 (2025-01-10): store release
Package Contents
Exact contents of the download archive (2 files):
| persistence_cookbook.py | 37,773 B |
| README.md | 1,909 B |
Related Tools
Malware Development
Process Hollowing Injector (C)
Malware Development
Reflective DLL Injection Template
Malware Development
Python RAT Core Module
Malware Development