# mandiant/SharPersist

Repository: https://github.com/mandiant/SharPersist
Canonical: https://ross.abutalabs.com/products/sharpersist
Language: C#
License: Apache-2.0
License Family: permissive
Archived: true
Last push: 2023-08-11T00:52:09+00:00

## Health v2 (maintenance only)
Score: 10/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 0, release rhythm 8, longevity 100
- inputs: {"age_days": 2630, "days_push": 1119, "days_rel": null, "gap_med": null, "n_releases_24m": 0}
- flags: archived
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 1542, forks 258 (observed 2026-08-28T04:05:01.138694+00:00)

## What it is
SharPersist is a Windows persistence toolkit written in C# that can add, remove, check, and list various persistence techniques such as registry run keys, scheduled tasks, startup folder shortcuts, Windows services, and KeePass config backdoors. It is intended for red team and penetration testing use on Windows systems.

## Use cases
- establish persistence on a windows machine during a red team engagement
- add a registry run key that executes a command at logon
- create a scheduled task that runs a payload daily or hourly
- backdoor an existing scheduled task with an extra action
- install a malicious windows service for persistence
- drop an lnk file in the startup folder
- backdoor a keepass config file
- list or remove existing persistence entries

## When to choose
- you need a single C# binary covering many windows persistence techniques
- you are performing authorized penetration testing or red team operations on windows
- you want add, remove, list, and dry-run (check) capabilities for persistence mechanisms
- you prefer a .NET tool that can be compiled or run in-memory

## When to avoid
- you need persistence on linux or macos
- you are a defender looking for detection tooling rather than offensive capability
- you need stealth features like AMSI or ETW bypasses, which are out of scope
- you require ongoing feature development, as the project is in maintenance mode

## Facets
- artifact type: cli-tool
- maturity: maintenance
- function: security, cli
- domain: security, penetration-testing, windows
- platform: windows, dotnet
- tags: persistence, red-team, offensive-security, csharp, post-exploitation

## Member repositories
- mandiant/SharPersist (main) score 10

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:05:01.138694+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T04:30:45.102987+00:00, confidence not recorded.
  - readme: https://github.com/mandiant/SharPersist (fetched 2026-08-28T04:05:01.138694+00:00, sha 2914d7abfa4b)
- Data as of 2026-08-30T08:39:29.467469+00:00.