07 · Persistence
Hunting Windows Persistence: Registry, Tasks, WMI and More
Find attacker persistence on Windows: Run keys, services, scheduled tasks, WMI, Winlogon, IFEO, COM hijacking and BITS, mapped to MITRE ATT&CK, with tools.
Area 07
Persistence
Attackers want to survive a reboot, and Windows offers them dozens of ways to do it. This area maps each persistence mechanism to MITRE ATT&CK, shows where it lives on disk and in the registry, which events record its creation, and how to sweep a host methodically.
Key sources
- Run keys
- Services
- Scheduled Tasks
Guides in this area
Artifact cheat sheets
Location by Windows version, what each artifact proves, its timestamps and the tools to parse it.
- Run keys and Startup foldersRun keys and Startup folders cheat sheet: Run, RunOnce, Wow6432Node and Policies paths, StartupApproved enabled/disabled bytes, timestamps and pitfalls.
- Windows ServicesWindows services cheat sheet: Services key values (ImagePath, Start, Type, ServiceDll), 7045 and 4697 install events, PsExec traces and pitfalls.
- Scheduled TasksScheduled tasks cheat sheet: task XML and .job files, TaskCache registry keys, DynamicInfo times, hidden tasks, TaskScheduler and 4698 events.
- WMI repository and SCCM RecentlyUsedAppsWMI repository cheat sheet: OBJECTS.DATA, event filters, consumers and bindings, WMI-Activity 5857–5861, MOF files and SCCM CCM_RecentlyUsedApps.
- IFEO and Winlogon persistenceIFEO and Winlogon cheat sheet: Debugger hijacks, GlobalFlag and SilentProcessExit, sticky keys backdoors, Userinit/Shell, Notify and AppInit_DLLs.
- BITS jobs (qmgr database)BITS jobs cheat sheet: qmgr0.dat/qmgr1.dat vs qmgr.db (ESE), Bits-Client events 3, 4, 59, 60, SetNotifyCmdLine persistence and BitsParser carving.
- Kernel Drivers (.sys, Driver Services, BYOVD)Kernel drivers cheat sheet: driver services (Type 1/2), event 7045, DriverStore, setupapi.dev.log, Amcache and CodeIntegrity logs to hunt BYOVD and rootkits.
- Group Policy artifactsGroup Policy cheat sheet: SYSVOL policies, Registry.pol, GPP passwords, client-side history and event logs, and how attackers abuse GPO for mass deployment.
- OpenSSH Server and ClientOpenSSH on Windows cheat sheet: sshd event log, sshd_config and host keys, authorized_keys persistence, known_hosts, client traces and reverse tunnels.
- Remote access tools (RMM)RMM and remote access tool cheat sheet: AnyDesk, TeamViewer, ScreenConnect and more, their log files, connection IDs, IPs and timestamps, and how to hunt abuse.
- IIS Web Server LogsIIS logs cheat sheet: W3C log location per site, UTC timestamps, default fields, HTTPERR, applicationHost.config and how to hunt webshells on Windows servers.