mirror of
https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git
synced 2026-08-04 18:00:18 +03:00
Mahipal
2fb6a9faff
Each rewritten description now states both what the skill does (concrete capability, named tools/artifacts) and an explicit when-to-use trigger, improving agent discovery/activation. Grounded in each skill's own body; changes confined to the `description` field only (bodies and all other frontmatter untouched). Produced by a gated audit->rewrite->recheck loop (548 -> 0 flagged) with a sampled anti-invention check (0 ungrounded). Schema: 817/817 pass. Framework-ID gate: 0 defects.
2.6 KiB
2.6 KiB
name, description, domain, subdomain, tags, version, author, license, d3fend_techniques, nist_csf, mitre_attack
| name | description | domain | subdomain | tags | version | author | license | d3fend_techniques | nist_csf | mitre_attack | |||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| hunting-for-startup-folder-persistence | Detects T1547.001 startup folder persistence by monitoring Windows startup directories for suspicious file creation, cross-referencing Autoruns entries, and running a Python watchdog script for real-time filesystem monitoring. Use when hunting for malware or implants that survive reboot via startup-folder placement, or when validating autoruns/EDR findings against known-good startup baselines. | cybersecurity | threat-hunting |
|
1.0 | mahipal | Apache-2.0 |
|
|
|
Hunting for Startup Folder Persistence
Overview
Attackers use Windows startup folders for persistence (MITRE ATT&CK T1547.001 — Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder). Files placed in %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup or C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup execute automatically at user logon. This skill scans startup directories for suspicious files, monitors for real-time changes using Python watchdog, and analyzes file metadata to detect persistence implants.
When to Use
- When investigating security incidents that require hunting for startup folder persistence
- When building detection rules or threat hunting queries for this domain
- When SOC analysts need structured procedures for this analysis type
- When validating security monitoring coverage for related attack techniques
Prerequisites
- Python 3.9+ with
watchdog,pefile(optional for PE analysis) - Access to Windows startup folders (user and all-users)
- Windows Event Logs for Event ID 4663 correlation (optional)
Steps
- Enumerate all files in user and system startup directories
- Analyze file types, creation timestamps, and digital signatures
- Flag suspicious file extensions (.bat, .vbs, .ps1, .lnk, .exe)
- Check for recently created files (< 7 days) as potential implants
- Monitor startup folders in real-time using watchdog FileSystemEventHandler
- Correlate with known legitimate startup entries
- Generate threat hunting report with T1547.001 MITRE mapping
Expected Output
- JSON report listing all startup folder contents with risk scores, file metadata, and suspicious indicators
- Real-time monitoring alerts for new file creation in startup directories