Persistence in the Windows Registry(T1547.001)

Persistence with Windows Scheduled Tasks (T1053.005)

Persistence with Windows Services (T1543.003)

BITS Jobs Persistence (T1197)

Persistence with WMI Event Subscription (T1546.003)

Persistence via Account Manipulation (T1098)

RID Hijacking (T1574)

Persistence via Boot or Logon Autostart (T1547.009)

Persistence Using VBA Macros and COM (T1566.001, T1546.015)

Persistence via LNK (Shortcut) File Abuse (T1547.009)

Persistence via DLL Hijacking (Search Order Hijacking & Side-Loading) (T1574.001, T1574.002)

Understanding Persistence

Persistence is a crucial technique used by malware authors to maintain access to a compromised system, even after reboots, logoffs, or credential changes. Attackers use various methods to achieve persistence, such as:

• Creating new user accounts
• Modifying registry run keys
• Installing malicious services
• Creating scheduled tasks
• Using WMI consumers

"Each of these techniques is discussed in detail on the pages above.”