Malware Persistence Analysis with Autoruns
Hunt for malware autostart entries on Windows using Sysinternals Autoruns output and triage rules
- Repository
- mukul975/Anthropic-Cybersecurity-Skills
- Stars
- 35,430
- Licence
- Apache-2.0
- Files
- 6 files
What it does
Once installed, the agent helps a security analyst look for ways malware survives reboots on a Windows computer, such as Run registry keys, scheduled tasks, services and drivers. It guides the use of Microsoft's free Autoruns tool, compares results against a known-good baseline, and runs a Python script that flags unsigned programs, unusual file locations and command-line tools often abused by attackers. Results are suggestions for human review, not verdicts.
Great for
- Incident responders triaging a possibly compromised Windows endpoint
- SOC analysts validating that all malware autostart entries have been removed
- Students learning how Windows persistence techniques map to MITRE ATT&CK
Skip it if
- Non-security users wanting general Windows troubleshooting, since it targets malware hunting specifically
- Relying on the script's flags alone to clear or delete entries, because the heuristics (e.g. any use of powershell or rundll32 is flagged) produce false positives and misses and deleting system entries can break a machine
Try asking
- “Analyze this Autoruns CSV export and list unsigned entries that run from AppData or Temp folders”
- “Compare my current Autoruns scan against our clean baseline and show new persistence entries”
- “Map the suspicious autostart entries on this host to MITRE ATT&CK techniques”
- “Write a checklist for validating that all persistence mechanisms were removed after an incident”
Install in 3 steps
- 1
Download the skill
The ZIP contains the 6 original files, the Apache-2.0 licence and an attribution note.
analyzing-malware-persistence-with-autoruns.zip - 2
Add it to your agent
Claude Code (all projects)
mkdir -p ~/.claude/skills && unzip analyzing-malware-persistence-with-autoruns.zip -d ~/.claude/skills/Claude Code / Agent SDK (this project only)
mkdir -p .claude/skills && unzip analyzing-malware-persistence-with-autoruns.zip -d .claude/skills/Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.
- 3
Ask for the task
No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.
Get better results
- Run scans with administrative rights and keep the original CSV exports as evidence before any cleanup
- Always capture a clean baseline on a known-good machine so the compare function has something meaningful to diff against
- Treat flagged entries as leads to verify against vendor documentation, hashes and VirusTotal rather than as confirmed malware
What's inside
- assets/template.md
- references/api-reference.md
- references/standards.md
- references/workflows.md
- scripts/agent.py
- SKILL.md
Redistributed unmodified from mukul975/Anthropic-Cybersecurity-Skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.