<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# API Reference — Detecting Persistence Mechanisms

## Persistence Detection APIs

### Sysinternals Autoruns CLI

| Command | Description |
|---|---|
| `autorunsc64 -a * -c` | Enumerate all autoruns as CSV |
| `autorunsc64 -a * -c -h -s` | Include hashes and verify signatures |
| `autorunsc64 -a * -c -v -vt` | Include VirusTotal results |
| `autorunsc64 -a * -c -m` | Show entries for current user only |

### Sysmon Persistence Events

| Event ID | Description |
|---|---|
| 6 | Driver loaded |
| 12 | Registry object added/deleted |
| 13 | Registry value set |
| 14 | Registry object renamed |
| 19 | WMI EventFilter activity |
| 20 | WMI EventConsumer activity |
| 21 | WMI FilterToConsumerBinding |

### Agent Script

```bash
# Enumerate scheduled tasks
node agent.js enum-tasks

# Check WMI persistence
node agent.js enum-wmi

# Compare autoruns baseline
node agent.js compare --baseline baseline.csv --current current.csv
```
