Skip to content
λmaldev wiki/
pagesPersistence

Persistence

Surviving a reboot without owning the boot chain. Mostly configuration abuse, which is why the detections here are inventory problems more than memory problems.

14 techniques
T1053.005
Scheduled Task Persistence
Register a Windows scheduled task to execute a payload on a schedule or system event.
T1542.003
Bootkit Persistence
Implant malicious code in the Master Boot Record or UEFI firmware to survive OS reinstallation and persist below the operating system.
T1543.003
Windows Service Creation
Install a malicious Windows service that auto-starts at boot under the SYSTEM account.
T1546.003
WMI Event Subscription
Register a permanent WMI consumer to execute a payload when a system event fires.
T1546.012
IFEO Debugger Hijack
Abuse the Image File Execution Options debugger key to intercept any process launch and silently substitute a malicious payload.
T1546.015
COM Hijacking via TreatAs
Remap a system CLSID to your own object so a trusted process loads it for you.
T1547.001
Active Setup
Use the Internet Explorer Active Setup key to run a command once for each user that logs on.
T1547.001
AppInit_DLLs & AppCertDlls
Register a DLL that Explorer or every new process loads at logon through AppInit or an AppCert certification hook.
T1547.001
Registry Run Keys
Write a value under a Run key so Windows executes a payload on every user logon.
T1547.001
Startup Folder
Drop an executable in a user or common Startup folder so the shell runs it at every logon.
T1547.004
Winlogon Userinit & Helper DLL
Point Winlogon's Userinit or register a Helper DLL so a payload loads into the logon manager at every interactive logon.
T1547.009
LNK File Hijacking
Plant or replace Windows shortcut files in Startup folders or on the desktop to execute arbitrary payloads on user logon.
T1574.001
DLL Search Order Hijacking
Plant a malicious DLL in a directory the loader searches before the legitimate one.
T1574.012
Print Spooler DLL Hijacking
Exploit the Windows Print Spooler service's dynamic loading of print provider and monitor DLLs to achieve persistence or privilege escalation.