Skip to content
Get packs

Offensive Persistence Tradecraft

Gives an agent Windows and Linux persistence techniques (registry, tasks, WMI, AD backdoors) for red team engagements.

Source Download skill
Repository
SnailSploit/Claude-Red
Stars
10,230
Licence
MIT
Files
1 file

What it does

This skill gives an AI agent a detailed reference of ways an attacker keeps access to a computer after it has already been compromised, so it survives reboots, logoffs and password changes. It covers Windows methods such as registry Run keys, scheduled tasks, WMI event subscriptions and Active Directory backdoors, and Linux methods such as cron, systemd, SSH keys and PAM backdoors. It supplies ready-to-run command sequences, OPSEC notes on how each method gets detected, and cleanup steps. It is written for authorized penetration testers and red teams, not for general system administration.

Great for

  • Authorized red team operators preparing persistence tests under a signed scope
  • Security students learning how persistence mechanisms work and how defenders detect them
  • Blue teams building detection rules who want to understand the attacker-side commands

Skip it if

  • Anyone without written authorization to test the target, since the commands are designed to backdoor real systems and evade detection
  • Ordinary IT or home users wanting to make software start automatically, because the instructions are framed around hiding payloads and evading defenders

Try asking

  • “Show me the registry Run key options for persistence on a Windows host I'm authorized to test, with cleanup commands”
  • “Compare cron, systemd timer and authorized_keys persistence on a Linux lab machine and list detection indicators for each”
  • “Walk me through the WMI event subscription method and how to remove it at engagement close”
  • “Map my planned persistence techniques to MITRE ATT&CK T1547 and T1053 for the report”

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 1 original files, the MIT licence and an attribution note.

    offensive-persistence.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip offensive-persistence.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip offensive-persistence.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Only use this with a written authorization and a defined scope; state the engagement context when asking the agent for help
  • Ask for detection indicators and cleanup steps alongside each technique so findings are reportable and reversible
  • Treat the output as operator notes: verify commands in a lab before running them against any client system

What's inside

  • SKILL.md

Redistributed unmodified from SnailSploit/Claude-Red under the MIT licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.