This repository contains three parts.

1. wmi_etw.py is the Cape plugin to detect WMI interactions with Cape Sandbox.
2. capa-rules contains our Capa rules that can be used to detect persistence within Cape reports.
3. persistence_hunter.py is the tools to that can be used to detect unknown persistence techniques.
4. data_analysis contains the data and analysis scripts.
5. docs contains the github pages website.

For the overview of persistence techniques visit [https://utwente-scs.github.io/Sok-Windows-Malware-Persistence/].