PyrsistenceSniper

PyrsistenceSniper is a tool for offline detection of Windows persistence mechanisms, enabling rapid checks from evidence collections such as KAPE dumps or mounted disk images without requiring live system access or administrative privileges. It boasts extensive coverage of over 130 persistence checks across various MITRE ATT&CK techniques, supports signature-based filtering for accurate detection, and offers customizable detection profiles, multiple output formats, and an extensible plugin architecture. The tool performs native registry parsing for efficient scanning, completing assessments in approximately 10 to 30 seconds on heavily utilized systems.