PersistenceSniper is a digitally signed PowerShell module aimed at blue teams and incident responders for automated detection of persistence mechanisms on Windows systems. It implements detection logic for techniques listed in MITRE ATT&CK (e.g. registry run keys, scheduled tasks, service modifications) and is regularly updated with new detection paths.
Features
- Detects persistence across run keys, scheduled tasks, services, and WMI
- Aligns with MITRE ATT&CK persistence techniques
- Digitally signed and published via PowerShell Gallery
- Lightweight module (~3000 lines), no external dependencies
- Regular releases adding detection capabilities
- Suitable for automation and integration into SOAR workflows
Project Samples
Categories
SecurityLicense
MIT LicenseFollow PersistenceSniper
You Might Also Like
MongoDB Atlas runs apps anywhere
MongoDB Atlas gives you the freedom to build and run modern applications anywhere—across AWS, Azure, and Google Cloud. With global availability in over 115 regions, Atlas lets you deploy close to your users, meet compliance needs, and scale with confidence across any geography.
Rate This Project
Login To Rate This Project
User Reviews
Be the first to post a review of PersistenceSniper!