Dargslan.WinPersistenceAudit

1.0.0

Audit Windows persistence locations: registry Run keys, scheduled tasks and unsigned autorun binaries. JSON / HTML report.

Minimum PowerShell version

5.1

Installation Options

Copy and Paste the following command to install this package using PowerShellGet More Info

Install-Module -Name Dargslan.WinPersistenceAudit

Copy and Paste the following command to install this package using Microsoft.PowerShell.PSResourceGet More Info

Install-PSResource -Name Dargslan.WinPersistenceAudit

You can deploy this package directly to Azure Automation. Note that deploying packages with dependencies will deploy all the dependencies to Azure Automation. Learn More

Manually download the .nupkg file to your system's default download location. Note that the file won't be unpacked, and won't include any dependencies. Learn More

Owners

Copyright

(c) 2026 Dargslan. All rights reserved.

Package Details

Author(s)

  • Dargslan

Tags

persistence dfir autorun scheduled-tasks run-keys audit windows sysadmin dargslan threat-hunting

Functions

Get-DargslanRunKeys Get-DargslanScheduledTasks Get-DargslanUnsignedAutoruns Get-DargslanPersistenceAuditReport Export-DargslanPersistenceAuditReport

Dependencies

  • .NETStandard 2.0

    • No dependencies.

Release Notes

Initial release. Run keys, scheduled tasks, signed/unsigned autorun classifier, scoring and HTML / JSON export.

FileList

Version History

Version Downloads Last updated
1.0.0 (current version) 4 4/18/2026