166 terms · 75/46/45
Technique № 011 · class: execution

Persistence

Persistence encompasses techniques by which an attacker ensures their access or malicious code survives system reboots, password changes, or other interruptions. The goal is to maintain a foothold in the environment over an extended period.

Term

description · examples · notes

Persistence encompasses techniques by which an attacker ensures their access or malicious code survives system reboots, password changes, or other interruptions. The goal is to maintain a foothold in the environment over an extended period.

Description

Typical mechanisms include modifying autostart entries, creating new user accounts, setting up scheduled tasks, altering system services, and embedding backdoors in legitimate components.

Examples

  • Adding a malicious entry to the operating system's autostart registry
  • Creating a hidden admin account on a compromised server
  • Setting up a scheduled task that periodically runs malicious code
  • Modifying a legitimate system service to include malicious code

Notes

  • Monitoring file and configuration integrity is key to detecting persistence mechanisms.

Mentioned in the news

Composite

Threats

used by 8

Defenses

countered by 6