Persistence 18 articles

Overview Boot or Logon Autostart Execution is a technique where adversaries configure malicious code or scripts to automatically execute during system boot or user logon. This method is commonly employed…

Overview Browser Extension Persistence is a technique used by adversaries to maintain long-term access and control within a victim’s environment by leveraging browser extensions. This method plays a critical role…

Overview Cloud Identity and Access Management (IAM) persistence mechanisms are techniques adversaries use to maintain long-term access within cloud environments by leveraging identity and access controls. These mechanisms enable attackers…

Overview Container persistence techniques enable adversaries to maintain long-term access within containerized environments by embedding malicious components or configurations that survive container restarts or redeployments. These techniques play a critical…

Overview DLL Search Order Hijacking for Persistence is a technique where adversaries exploit the way Windows operating systems locate Dynamic Link Libraries (DLLs) to execute malicious code. By placing a…

Overview Firmware-level persistence is a technique where adversaries implant malicious code within the firmware of hardware components to maintain long-term access to a compromised system. This method enables attackers to…

Overview Golden Image Backdooring is a technique where adversaries compromise a master system image used for deploying multiple endpoints or servers by embedding malicious code or backdoors. This technique enables…

Overview Group Policy Object (GPO) abuse involves adversaries leveraging the administrative framework of Microsoft Active Directory to manipulate system and user configurations across a network. This technique enables attackers to…

Overview Kernel-Level Persistence is a technique used by adversaries to maintain long-term access and control over a compromised system by embedding malicious code or components within the operating system kernel.…

Overview Local Account Creation Persistence is a technique used by adversaries to maintain long-term access to compromised systems by creating new local user accounts. This method supports persistence within the…

Overview Malicious driver installation is a technique where adversaries install unauthorized or tampered device drivers on a target system to gain elevated privileges, maintain persistence, or evade security controls. This…

Overview OAuth Application Abuse involves adversaries exploiting OAuth authorization flows to gain unauthorized access to resources or escalate privileges within a target environment. This technique is leveraged at various stages…

Overview Registry Run Keys and Startup Folder Persistence are common techniques used by adversaries to maintain access and ensure execution of malicious code upon system startup or user logon. These…

Overview Scheduled Task Persistence is a technique where adversaries create or modify scheduled tasks to maintain long-term access to a compromised system. This method leverages legitimate operating system features to…

Overview Service Creation Persistence is a technique used by adversaries to maintain long-term access to compromised systems by creating or modifying system services. This technique plays a critical role in…

Overview Startup Script Modification is a technique where adversaries alter scripts that execute automatically during system or user startup. This method is used to maintain persistence, execute malicious code early…

Overview Web shell persistence is a technique where adversaries deploy malicious scripts on compromised web servers to maintain long-term access and control. This method enables attackers to execute commands, upload…

Overview WMI Event Subscription Persistence is a technique where adversaries leverage Windows Management Instrumentation (WMI) event subscriptions to maintain persistent access on a compromised system. By registering event consumers and…