Live-system incident response is inherently noisy, risky, and prone to evasion. When an adversary establishes persistence, querying a live operating system often means contending with running rootkits, locked registry handles, or active anti-forensics routines. Offline triage across dead-box images, KAPE dumps, and mounted forensic storage solves this problem, but it usually introduces a brutal performance penalty. Parsing raw registry hives and cross-checking disk artifacts manually across hundreds of persistence locations eats up valuable incident response hours.
Hexastrike built PyrsistenceSniper to break this bottleneck. Designed as a Python-powered offline detection engine, the utility inspects dead-box artifacts and forensic snapshots across Windows, Linux, and macOS. It processes 117 distinct persistence mechanisms in under 30 seconds, bringing native hive parsing, automated validation, and fine-tuned noise reduction to the front lines of digital forensics.
[ Dead-Disk / KAPE / Mounted Image ]
│
▼
┌──────────────────────────────────┐
│ PyrsistenceSniper Engine │
│ - Native libregf Registry Parsing │
│ - Offline Forensic Processing │
└────────────────┬─────────────────┘
│
┌────────────────┴─────────────────┐
▼ ▼
┌───────────────┐ ┌───────────────┐
│ Authenticode │ │ YAML Ruleset │
│ Validation │ │ Noise Filter │
└───────┬───────┘ └───────┬───────┘
│ │
└────────────────┬─────────────────┘
▼
[ Enriched Triage Artifacts ]
- MITRE ATT&CK Mapping (9)
- SHA-256 / File Checks
- LOLBin Identifications
- Interactive HTML / CSV / XLSX
Native Registry Parsing Without the Overhead
Inspired by tools like Autoruns and PersistenceSniper, PyrsistenceSniper tackles the performance limits of forensic analysis by avoiding OS-level dependencies. It leverages the libregf library to directly parse raw registry hives extracted from offline images.
Parsing the binary format directly via libregf allows the engine to sweep through highly active system snapshots without mounting hives through the Windows API or spinning up virtual environments. This architecture is what unlocks the sub-30-second execution window. IR teams running initial triage on massive disk images get near-instant identification of suspicious registry modifications, hijacked paths, and atypical service configurations.
Beyond Paths: Deep Artifact Validation
Spotting a suspicious key path is only half the battle. Adversaries routinely blend in by swapping out binaries or utilizing DLL proxying tricks to fool value-based allowlists. PyrsistenceSniper counters this by pairing path checks with active artifact validation.
Every auto-finding surfaces through a rigorous validation pipeline:
| Validation Feature | Mechanism & Purpose |
|---|---|
| Authenticode Verification | Validates digital signatures directly to separate legitimate OS code from rogue binaries or hijacked execution chains. |
| Integrity Profiling | Executes file existence checks and generates SHA-256 hashes for all discovered persistence artifacts. |
| LOLBin Identification | Flags Living Off the Land Binaries to spot legitimate system tools abused for malicious execution flows. |
| MITRE ATT&CK Mapping | Links persistence artifacts directly across 9 distinct MITRE ATT&CK techniques. |
This automated enrichment means analysts do not spend time manually generating hashes or validating code-signing certificates on every hit. The rich terminal output immediately presents whether a file exists, its cryptographic signature, and how it aligns with known adversary tradecraft.
Suppressing the Noise Floor with YAML Profiles
The biggest threat to rapid digital forensics is alert fatigue. Standard operating systems ship with hundreds of legitimate auto-start entries, background runners, and third-party helpers.
PyrsistenceSniper handles signal-to-noise ratio via customizable YAML detection profiles. These profiles can be deployed globally across an entire fleet or scoped to individual target scans.
Incoming Findings ──► [ Block Rules Evaluated ] ──► (Match) ──► Flagged High-Severity
│
(No Match)
│
▼
[ Allow Rules Evaluated ] ──► (Match) ──► Suppressed (~90% Vol Drop)
│
(No Match)
│
▼
[ Standard Anomaly Output ]
The evaluation engine prioritizes block rules first. Any match against a blocklist is instantly escalated as a high-severity detection. Conversely, allow rules suppress verified noise, such as trusted Microsoft-signed binaries that match known baseline specifications.
In production forensic runs, this targeted YAML suppression slashes total output volume by up to 90 percent. Defenders maintain laser focus on anomalous behavior rather than wading through known-good operating system artifacts.
Cross-Platform Surface and Attack Surface Coverage
While Windows remains the most heavily targeted operating system for persistence mechanics, PyrsistenceSniper provides unified triage capability across Windows, Linux, and macOS.
The Windows check catalog covers 117 persistence mechanisms across critical attack surfaces:
- Hijacked execution flows
- Modified authentication processes
- Service installations and driver registrations
- Scheduled tasks and run key anomalies
Hexastrike maps these 117 checks across nine core MITRE ATT&CK techniques. This standard classification enables threat hunters to aggregate results across multiple machines to spot campaign-wide persistence trends.
IR Integration and Deployment Workflows
Speed during an active incident depends heavily on how cleanly a tool integrates into existing triage pipelines. PyrsistenceSniper exports data into multiple structured formats to suit the task at hand:
- Interactive HTML Reports: Fully dynamic reports with UI sorting and filtering by severity for standalone investigation.
- CSV and XLSX Exports: Structured spreadsheets designed to correlate indicators across dozens of endpoints simultaneously in external analysis tools.
- Rich CLI Output: Visual terminal summaries for quick command-line verification.
Installation via PyPI
You can install the engine directly from the Python Package Index:
bashpip install pyrsistencesniper
Containerized Execution
For air-gapped forensic workstations or clean room analysis systems where you want zero dependency conflicts, Hexastrike publishes an official Docker container:
bash# Pull the official image docker pull hexastrike/pyrsistencesniper # Execute a forensic scan docker run --rm -v /path/to/triage:/data hexastrike/pyrsistencesniper <pyrsistencesniper_command>
By decoupling registry inspection from the underlying OS, validating Authenticode signatures, and suppressing up to 90 percent of baseline noise, PyrsistenceSniper shifts offline persistence hunting from a slow forensic chore into a fast, repeatable triage step.