Persistence
Surviving a reboot without owning the boot chain. Mostly configuration abuse, which is why the detections here are inventory problems more than memory problems.
14 techniques
T1053.005Windows08-04T1542.003Windows, Linux08-04T1543.003Windows08-04T1546.003Windows08-04T1546.012Windows08-04T1546.015Windows07-11T1547.001Windows09-04T1547.001Windows09-04T1547.001Windows08-04T1547.001Windows09-04T1547.004Windows09-04T1547.009Windows08-04T1574.001Windows08-04T1574.012Windows08-04
Scheduled Task Persistence
Register a Windows scheduled task to execute a payload on a schedule or system event.
Bootkit Persistence
Implant malicious code in the Master Boot Record or UEFI firmware to survive OS reinstallation and persist below the operating system.
Windows Service Creation
Install a malicious Windows service that auto-starts at boot under the SYSTEM account.
WMI Event Subscription
Register a permanent WMI consumer to execute a payload when a system event fires.
IFEO Debugger Hijack
Abuse the Image File Execution Options debugger key to intercept any process launch and silently substitute a malicious payload.
COM Hijacking via TreatAs
Remap a system CLSID to your own object so a trusted process loads it for you.
Active Setup
Use the Internet Explorer Active Setup key to run a command once for each user that logs on.
AppInit_DLLs & AppCertDlls
Register a DLL that Explorer or every new process loads at logon through AppInit or an AppCert certification hook.
Registry Run Keys
Write a value under a Run key so Windows executes a payload on every user logon.
Startup Folder
Drop an executable in a user or common Startup folder so the shell runs it at every logon.
Winlogon Userinit & Helper DLL
Point Winlogon's Userinit or register a Helper DLL so a payload loads into the logon manager at every interactive logon.
LNK File Hijacking
Plant or replace Windows shortcut files in Startup folders or on the desktop to execute arbitrary payloads on user logon.
DLL Search Order Hijacking
Plant a malicious DLL in a directory the loader searches before the legitimate one.
Print Spooler DLL Hijacking
Exploit the Windows Print Spooler service's dynamic loading of print provider and monitor DLLs to achieve persistence or privilege escalation.
no techniques match those filters.