Can this skill be used for defensive security purposes?

Yes, it includes a dedicated 'Persistence Detection' section with commands to help security auditors identify and remove unauthorized persistence mechanisms.

Which operating systems are supported by this persistence skill?

The skill provides comprehensive techniques for Windows (Registry, WMI, Services), Linux (Cron, Systemd, SSH), and container environments like Docker and Kubernetes.

Are rootkits covered in these techniques?

The skill includes high-level guidance on both user-mode and kernel-mode rootkits, including Loadable Kernel Modules (LKM) for Linux.

Does it include cloud-specific persistence methods?

Yes, it covers IAM user creation and policy attachment for AWS, as well as Service Principal and Identity management for Azure environments.

What types of web shells are included in the documentation?

The skill provides implementation patterns for PHP, ASP/ASPX, and JSP web shells, including common upload locations and obfuscation tips.

Establishing Persistence Techniques

Name: Establishing Persistence Techniques
Author: trilwu

bytrilwu

Security & Testing

Implements and detects various methods for maintaining long-term access to compromised Windows, Linux, and cloud environments during security engagements.

About

This skill equips Claude Code with a comprehensive library of persistence techniques used in red team operations and penetration testing. It provides expert-level guidance on establishing reliable backdoors via registry keys, scheduled tasks, systemd services, SSH keys, and cloud-specific persistence in AWS and Azure. Designed for security professionals, the skill covers cross-platform methodologies from user-mode techniques to kernel-mode rootkits, while also providing crucial detection patterns to help audit and secure infrastructure against unauthorized access.

Key Features

Cloud-native persistence strategies for AWS IAM and Azure Service Principals
0 GitHub stars
Detection and remediation commands to audit and clear persistence mechanisms
Detailed registry, scheduled task, and service manipulation for Windows environments
Cron job, systemd, and SSH key persistence implementations for Linux systems
Cross-platform persistence patterns for Windows, Linux, and containerized environments

Use Cases

Security testing to validate Endpoint Detection and Response (EDR) effectiveness
Red team operations requiring stealthy, long-term access to target systems
Post-exploitation research and backdoor analysis for security audits

About

Key Features

Cloud-native persistence strategies for AWS IAM and Azure Service Principals
0 GitHub stars
Detection and remediation commands to audit and clear persistence mechanisms
Detailed registry, scheduled task, and service manipulation for Windows environments
Cron job, systemd, and SSH key persistence implementations for Linux systems
Cross-platform persistence patterns for Windows, Linux, and containerized environments

Use Cases

Security testing to validate Endpoint Detection and Response (EDR) effectiveness
Red team operations requiring stealthy, long-term access to target systems
Post-exploitation research and backdoor analysis for security audits