mandiant/SharPersist

Health v2 · maintenance only

Flags: archived

Adoption not part of the score

1542 stars · 258 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

SharPersist is a Windows persistence toolkit written in C# that can add, remove, check, and list various persistence techniques such as registry run keys, scheduled tasks, startup folder shortcuts, Windows services, and KeePass config backdoors. It is intended for red team and penetration testing use on Windows systems.

Use cases

• establish persistence on a windows machine during a red team engagement
• add a registry run key that executes a command at logon
• create a scheduled task that runs a payload daily or hourly
• backdoor an existing scheduled task with an extra action
• install a malicious windows service for persistence
• drop an lnk file in the startup folder
• backdoor a keepass config file
• list or remove existing persistence entries

When to choose

• you need a single C# binary covering many windows persistence techniques
• you are performing authorized penetration testing or red team operations on windows
• you want add, remove, list, and dry-run (check) capabilities for persistence mechanisms
• you prefer a .NET tool that can be compiled or run in-memory

When to avoid

• you need persistence on linux or macos
• you are a defender looking for detection tooling rather than offensive capability
• you need stealth features like AMSI or ETW bypasses, which are out of scope
• you require ongoing feature development, as the project is in maintenance mode

Facets

cli-tool · maturity maintenance

security cli security penetration-testing windows windows dotnet persistence red-team offensive-security csharp post-exploitation

Member repositories

For agents

markdown · JSON · MCP: product_card(name="mandiant/SharPersist")