PyrsistenceSniper detects 117 persistence malware techniques

Key Takeaways

• Hexastrike has released PyrsistenceSniper, a new Python-based tool for detecting 117 distinct offline persistence mechanisms across Windows, Linux, and macOS environments.
• The tool facilitates rapid forensic analysis of disk images and data collections by identifying anomalies linked to MITRE ATT&CK techniques.
• PyrsistenceSniper offers flexible deployment options, including a Docker container, and supports customizable detection profiles to reduce alert fatigue.

Hexastrike Unveils PyrsistenceSniper for Advanced Persistence Detection

Hexastrike has introduced PyrsistenceSniper, a sophisticated new tool designed to assist cybersecurity analysts in identifying offline persistence techniques across Windows, Linux, and macOS operating systems. This Python-based solution is capable of detecting 117 unique persistence mechanisms, providing a critical asset for forensic investigations.

Drawing inspiration from established tools like Autoruns and PersistenceSniper, PyrsistenceSniper streamlines the triage process for forensic data collections. Its key advantage lies in its ability to operate without requiring live access to compromised systems, instead analyzing mounted disk images, Velociraptor collections, and KAPE dumps directly. According to the Hexastrike GitHub repository, the tool leverages the libregf library for native registry hive parsing, allowing it to perform comprehensive scans of heavily utilized systems in less than thirty seconds.

Streamlining Forensic Analysis

Analysts at Hexastrike highlight PyrsistenceSniper’s capability to employ signature-based filtering. This feature enables investigators to validate Authenticode signatures, effectively distinguishing legitimate operating system processes from potentially malicious persistence attempts.

The command-line interface of PyrsistenceSniper offers detailed terminal output, visually flagging anomalies that correspond to recognized MITRE ATT&CK techniques. This direct correlation aids security teams in quickly understanding the nature of detected threats.

Security researchers also note the tool’s support for standalone artifact scanning. This functionality is particularly beneficial when complete directory structures are unavailable, allowing for the analysis of isolated files such as NTUSER.DAT or the SYSTEM hive.

Maurice Fielenbach emphasized that each finding generated by PyrsistenceSniper is automatically enriched with crucial context, including file existence checks, SHA-256 hashes, and classifications against known Living Off the Land Binaries (LOLBins). This automated enrichment significantly accelerates the incident response workflow.

Customization and Alert Suppression

Cybersecurity professionals can tailor PyrsistenceSniper’s behavior through YAML-based detection profiles. These profiles allow for the customization of allow and block rules, applicable either globally or to specific checks. Hexastrike documentation clarifies that block rules take precedence, automatically assigning high severity to matching detections while simultaneously filtering out known-good entities, such as Microsoft-signed binaries.

Threat hunters assert that this targeted suppression mechanism is instrumental in eliminating redundant alerts, frequently reducing the total output volume by up to ninety percent during forensic analysis, thereby improving efficiency.

MITRE ATT&CK Alignment and Reporting

Hexastrike has meticulously aligned PyrsistenceSniper’s unique persistence checks with nine distinct MITRE ATT&CK techniques, ensuring standardized threat reporting. Security teams utilize these categorizations to track a wide array of mechanisms, from hijacked execution flows to modified authentication processes, across compromised environments.

The following table illustrates a cross-section of specific persistence techniques identified by PyrsistenceSniper:

Forensic investigators have multiple options for exporting PyrsistenceSniper findings, including console, CSV, HTML, and XLSX formats, facilitating seamless integration with existing analysis workflows. Recent updates, as highlighted by Maurice Fielenbach, introduced interactive HTML reports that empower defenders to dynamically filter and sort severity ratings. Incident response teams frequently leverage the CSV and XLSX outputs to stack anomalous indicators across multiple compromised systems for comparative analysis.

Deployment and Accessibility

Security engineers can install PyrsistenceSniper directly from the Python Package Index using standard package managers or by compiling it from the official source code. The development team also provides an official Docker container, offering analysts a convenient method to scan triage collections without the need for configuring local Python environments or system dependencies. This containerized approach is particularly favored by digital forensics professionals for dynamically exporting full HTML reports and CSV files during active incident response engagements.

What You Should Do

• Integrate PyrsistenceSniper: Deploy PyrsistenceSniper in your forensic toolkit for comprehensive offline persistence detection across Windows, Linux, and macOS.
• Utilize Custom Profiles: Develop and implement YAML-based detection profiles to customize allow and block rules, reducing alert fatigue and focusing on critical threats.
• Leverage Export Features: Export findings into CSV, HTML, or XLSX formats for seamless integration with existing analysis workflows and for cross-system comparison.
• Consider Docker Deployment: For ease of deployment and environment consistency, utilize the official Docker container for PyrsistenceSniper, especially during active incident response.
• Stay Updated: Regularly check for updates and new releases of PyrsistenceSniper to benefit from enhanced detection capabilities and features.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.