RB-ANALYSIS-014: Malware Persistence Mechanism Hunt

Document Control

1. Prerequisites

• EDR telemetry
• Registry activity
• Scheduled task logs
• Service creation logs
• Startup artefacts
• Access to EDR platform
• Access to Autoruns
• Access to PowerShell
• Access to registry analysis tools
• Access to SIEM

2. Step-by-Step Instructions

1. Review Startup Persistence

   • Check:
     • Startup folders
     • Registry Run keys
     • Startup scripts
     • Login items

2. Identify Scheduled Tasks

   • Review:
     • Newly created tasks
     • Suspicious execution paths
     • Obfuscated task names
     • Hidden tasks

3. Review Services

   • Identify:
     • Newly installed services
     • Suspicious service binaries
     • Unsigned service executables
     • Unusual service descriptions

4. Review WMI Persistence

   • Check for:
     • WMI event subscriptions
     • Suspicious consumers
     • Malicious filters

5. Identify Registry Persistence

   • Review:
     • Run keys
     • Shell modifications
     • File association hijacking
     • Defender exclusions

6. Assess Enterprise Scope

   • Determine:
     • Single-host persistence
     • Shared persistence patterns
     • GPO-based persistence
     • Multi-host compromise

3. Post-Action

• Document all newly identified compromised accounts, hosts, and entities discovered during the investigation
• Record any new IOCs (hashes, IPs, domains, accounts, tokens, signatures) in the incident ticket

Contributor

Vishal Thakur GitHub: https://github.com/malienist

Jayden Vo GitHub: https://github.com/jayden-vo

Contributed to the Arcana Incident Response Documentation Framework.