Reinfection Risk & Host Persistence Hunter
PILLAR 4 · VALIDATEContinuous deep-inspection of restored systems for dormant adversary footholds, rogue tasks, webshells & C2 beacons.
Critical Footholds
1
Unchecked dormant scheduled tasks & webshells
Active Vectors Flagged
1
Requiring immediate remediation action
Eradicated Artifacts
2
Purged & verified by cryptographic hash
Reinfection Risk Index
HIGH
Target: Clean (Zero Active Artifacts)
| Host & IP | Category | MITRE TTP | Severity | Status | Actions |
|---|---|---|---|---|---|
DC01.mercy.local 10.14.2.10 | PERSISTENCE | T1053.005 (Scheduled Task) | CRITICAL | QUARANTINED | |
APP-IIS-04.mercy.local 10.14.4.22 | WEBSHELL | T1505.003 (Web Shell) | CRITICAL | CLEARED | Clean |
HYPERV-NODE-02.mercy.local 10.14.1.12 | C2_BEACON | T1071.004 (DNS C2) | HIGH | CLEARED | Clean |
Select an artifact from the table
Inspect decoded payload, registry paths, and trigger automated eradication routines.
AEGIS HUNTER TELEMETRY FEED
LIVE STREAM[00:15:02] [HUNTER-ENGINE] Initializing deep persistence hunter v4.2...
[00:15:05] [HUNTER-T1053] Scanning DC01.mercy.local TaskCache registry -> DETECTED 'WindowsUpdateCheck_Svc'
[00:15:10] [HUNTER-T1505] Inspecting IIS wwwroot directories on APP-IIS-04 -> WEBSHELL detected
[00:15:15] [HUNTER-T1071] Analyzing outbound DNS queries on HYPERV-NODE-02 -> Active C2 TXT tunnel detected
[00:15:20] [HUNTER-ENGINE] Scan completed: 3 residual persistence vectors flagged for containment.
MITRE ATT&CK Enterprise Matrix (TA0003: Persistence & TA0011: C2)
Monitored techniques: T1053 (Scheduled Task), T1543 (Create/Modify System Process), T1505.003 (Webshell), T1071 (Application Layer Protocol C2), T1078 (Valid Accounts).