Demonstrates various persistence techniques used by malware, including COM hijacking, extension hijacking, and shim injection.
Persistence Demos is a collection of practical examples demonstrating various persistence techniques used by malware to maintain access on Windows systems. It includes methods like COM hijacking, extension hijacking, shim injection, and exploiting restricted directories. The project helps security professionals understand and analyze how malware achieves persistence in real-world attacks.
Security researchers, malware analysts, red teamers, and cybersecurity students who need to study or simulate malware persistence mechanisms for defensive or educational purposes.
It provides hands-on, reproducible demos of non-standard persistence methods that are often overlooked, making it a valuable resource for deep dives into malware behavior beyond common techniques.
Demos of various (also non standard) persistence methods used by malware
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
The project provides runnable code for COM hijacking, extension hijacking, shim persistence, and restricted directory exploitation, allowing practical study of these techniques as listed in the README.
It covers non-standard persistence methods like shim injection and restricted directory exploitation, which are often overlooked in basic security resources, making it valuable for deep dives.
Associated with the 'Wicked malware persistence methods' presentation mentioned in the README, it serves as a practical companion for learning from authoritative sources.
The README includes a build status badge from AppVeyor, indicating that the project is regularly tested and maintained for reliability.
Only four persistence methods are demonstrated, missing common ones like registry run keys or scheduled tasks, which reduces its comprehensiveness for broader malware analysis.
The README is brief and lacks detailed setup instructions, code explanations, or troubleshooting guides, making it less accessible for those new to the topic.
All demos are specific to Windows, so it cannot be used for studying malware persistence on Linux, macOS, or other operating systems, limiting its applicability.