Persistence
Persistence encompasses techniques by which an attacker ensures their access or malicious code survives system reboots, password changes, or other interruptions. The goal is to maintain a foothold in the environment over an extended period.
Term
description · examples · notesPersistence encompasses techniques by which an attacker ensures their access or malicious code survives system reboots, password changes, or other interruptions. The goal is to maintain a foothold in the environment over an extended period.
Description
Typical mechanisms include modifying autostart entries, creating new user accounts, setting up scheduled tasks, altering system services, and embedding backdoors in legitimate components.
Examples
- Adding a malicious entry to the operating system's autostart registry
- Creating a hidden admin account on a compromised server
- Setting up a scheduled task that periodically runs malicious code
- Modifying a legitimate system service to include malicious code
Notes
- Monitoring file and configuration integrity is key to detecting persistence mechanisms.
Mentioned in the news
- 28. MAR 2026. Sandworm zloupotrebljava RDP servere za malware i dugotrajan pristup mreži →
- 6. MAJ 2026. Phishing kampanja koristi SimpleHelp i ScreenConnect za trajni udaljeni pristup →
- 1. MAJ 2026. FIRESTARTER backdoor kompromitovao Cisco Firepower uređaj američke agencije →
- 28. APR 2026. Firestarter backdoor može da preživi zakrpe na Cisco uređajima →
- 28. APR 2026. Zaraženi Cisco firewall uređaji traže hladni start za uklanjanje Firestartera →
- 28. MAR 2026. Kineski povezani akteri upali u vojne sisteme u jugoistočnoj Aziji →
- 23. MAR 2026. CanisterWorm proširio Trivy supply chain napad na desetine npm paketa →
- 14. MAR 2026. Kineska APT kampanja cilja vojne organizacije u jugoistočnoj Aziji →
- 4. MAR 2026. APT41 povezana kampanja Silver Dragon cilja organizacione mreže →
Threats
used by 8Threats that use it. Select one to open its page.
Defenses
countered by 6How it is countered. Select one to open its page.