How to use the Malware Persistence Analysis with Autoruns agent skill

What does the skill make the agent do?

Once installed, the agent helps a security analyst look for ways malware survives reboots on a Windows computer. These include Run registry keys, scheduled tasks, services and drivers. The skill describes Sysinternals Autoruns, Microsoft's free tool, which scans hundreds of Auto-Start Extensibility Points (ASEPs) across 18+ categories such as Run/RunOnce keys, services, scheduled tasks, drivers, Winlogon entries, WMI subscriptions and AppInit DLLs.

The skill also covers comparing results against a clean baseline export to find newly added persistence, checking hash reputation through VirusTotal, and examining offline disk images with the -z flag. It includes a Python script that flags unsigned programs, unusual file locations and command-line tools often abused by attackers. The flags are suggestions for human review, not verdicts.

Install the skill (ZIP download or Claude Settings)

Download the skill ZIP from this page and unzip it. For a personal setup, place the unzipped folder in ~/.claude/skills/. For a single project, place it in that project's .claude/skills/ folder.

In the Claude apps you can instead upload the skill under Settings → Capabilities → Skills.

• Personal: ~/.claude/skills/
• Project: .claude/skills/ inside your project folder
• Claude apps: Settings → Capabilities → Skills, then upload

Check the requirements before you start

The skill assumes a Windows system and a set of tools. Confirm you have all of them before relying on the output.

• Windows with Sysinternals Autoruns (GUI) and Autorunsc (CLI)
• Administrative privileges on the target system
• Python 3.9+
• A VirusTotal API key, only needed for optional hash reputation checks
• A clean baseline Autoruns export for comparison

Trigger the skill with natural requests

You do not need special syntax. Describe the task in plain language, mentioning Windows, persistence, autostart or Autoruns. The skill's description targets Windows incident response, triaging a compromised endpoint, and validating that malware autostart entries have been fully removed.

• "Help me check this Windows endpoint for malware persistence using Autoruns."
• "Compare this Autoruns export against our clean baseline and show me new autostart entries."
• "Which unsigned Run key or service entries should I investigate on this machine?"
• "Check whether all malware autostart entries were removed after cleanup."

Run the scan and review the flags

The bundled script runs autorunsc with the -a * flag to scan all categories, outputs CSV, and then flags entries. Its checks include unsigned or unverified binaries, missing description and company metadata, executables in temp or public user folders, and launch strings containing powershell, cmd /c, wscript, mshta or regsvr32.

Treat every flag as a lead to investigate. The skill notes that heuristics produce false positives and misses. For example, any use of powershell or rundll32 is flagged, even when legitimate.

• Unsigned binary
• Missing metadata
• Suspicious path
• LOLBin: <keyword>

Use the report template and baseline comparison

The skill includes a report template with sample information (SHA-256, file type, analysis date, analyst), a findings table with severity, an IOC table, and recommendations. Use it to document what you found.

Validation criteria in the skill are simple: all ASEP categories scanned and cataloged, unsigned entries flagged, suspicious paths and LOLBin strings highlighted, and new persistence identified against the baseline.