registry_get_persistence
Identify malware persistence by extracting Run keys, Winlogon values, and services from registry hives.
Instructions
Get persistence mechanisms (Run keys, Winlogon values, services) from registry.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| ntuser_hive | No | ||
| system_hive | No | ||
| software_hive | No | ||
| include_microsoft_services | No |