Persistence

Persistence covers every mechanism that lets malicious code or an attacker regain execution after a reboot, a logoff or a credential change. MITRE ATT&CK treats it as a dedicated tactic, and on Windows the list of possible locations is long.

The most frequent mechanisms are Run keys and Startup folders, services and scheduled tasks. Beyond these, investigators regularly meet WMI event subscriptions, Image File Execution Options debuggers, Winlogon Shell and Userinit values, COM hijacking and BITS jobs with notification commands. Some mechanisms run at boot as SYSTEM, others only when a specific user logs on, which affects both impact and attribution.

Each mechanism leaves creation traces worth dating. Registry-based entries can be dated by the key's LastWrite time; service and task creation produce event IDs such as 7045 and 4698 when the relevant logging is active; and the files they point to have their own file system timestamps. On a live machine, Sysinternals Autoruns gives a broad overview; offline, registry parsers and triage tools cover the same locations from collected hives.

When reviewing entries, focus on what is unusual rather than what is unknown: binaries in user-writable folders, script interpreters or LOLBins with long command lines, names that imitate legitimate components, and entries created close to other suspicious activity on the timeline.