A curated collection of information and tools for detecting, analyzing, and hunting malware persistence mechanisms across operating systems.
Malware Persistence is a curated collection of information and resources focused on how malware maintains access on compromised systems after initial infection. It addresses the gap in many malware analyses that overlook persistence mechanisms, which are more static and reliable for detection than IPs or hashes. The repository serves as a reference for threat hunters, incident responders, and security analysts to identify and mitigate persistent threats.
Incident responders, threat hunters, and security analysts performing compromise assessments or infrastructure monitoring. It's also valuable for red teams testing detection capabilities and security engineers building detection pipelines.
It consolidates scattered, hard-to-find persistence information into a single, regularly updated resource, saving time for security professionals. Unlike generic threat intelligence feeds, it focuses specifically on persistence—a high-signal, low-noise attack vector—with practical detection examples and tool recommendations.
Collection of malware persistence and hunting information. Be a persistent persistence hunter!
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Details persistence techniques for Linux, macOS, Windows, and cloud environments, including common and advanced methods, as outlined in the 'Overview of commonly used persistence mechanisms' section.
Aggregates links to key sources like MITRE ATT&CK, Hexacorn's blog, Sigma rules, and forensic artifacts, saving researchers time by compiling scattered detection information.
Provides real-world examples such as cron job abuses and registry manipulations, with analysis approaches that aid in actual threat hunting and incident response.
Regularly updated with new detection resources and tools, welcoming pull requests to keep the content current with evolving malware tactics.
Only lists external tools like Autoruns and PersistenceSniper; users must separately install and configure these for practical use, adding overhead.
Geared towards experienced incident responders and threat hunters, with little introductory material, making it inaccessible for newcomers.
The extensive aggregation of resources and links can be overwhelming without prioritization or a structured learning path for specific use cases.