Persistence

Adversaries may use scripts automatically executed at boot or logon initialization to establish persistence.

Detect it with
Monitor logon scripts for unusual access by abnormal users or at abnormal times. Look for files added or modified by unusual accounts outside of normal administration duties.

schtasks, cron, at, and systemd timers used both to execute now and to survive a reboot.

Detect it with
Event ID 4698 (task created); new cron entries; tasks whose action points at a user-writable path.

Logging in with legitimate stolen credentials — the quietest way in and the hardest to distinguish from normal work.

Detect it with
Impossible travel, first-time ASN or country for the user, MFA fatigue patterns, logins outside the user's baseline hours.

Adding credentials to an existing account — SSH keys, app registrations, additional MFA devices.

Detect it with
New MFA method registered immediately after a suspicious sign-in; new service principal credentials in cloud audit logs.

Adversaries may interact with the Windows Registry as part of a variety of other techniques to aid in defense evasion, persistence, and execution.

Detect it with
Modifications to the Registry are normal and occur throughout typical use of the Windows operating system.

VPN, RDP gateways, Citrix, and VDI accessed directly with valid or brute-forced credentials.

Detect it with
VPN logins from residential proxy or VPS ranges; RDP exposed to the internet at all is a finding on its own.

New local, domain, or cloud accounts created to provide a durable second way in.

Detect it with
Event ID 4720 (account created) and 4732 (added to privileged group), especially outside business hours.

Adversaries may leverage Microsoft Office-based applications for persistence between startups. Microsoft Office is a fairly common application suite on Windows-based operating systems within an enterprise network.

Detect it with
Collect process execution information including process IDs (PID) and parent process IDs (PPID) and look for abnormal chains of activity resulting from Office processes. Non-standard process execution trees may also indicate suspicious or malicious behavior.

Adversaries may abuse software extensions to establish persistent access to victim systems.

Detect it with
Inventory and monitor browser extension installations that deviate from normal, expected, and benign extensions. Process and network monitoring can be used to detect browsers communicating with a C2 server.

Adversaries may abuse BITS jobs to persistently execute code and perform various background tasks. Windows Background Intelligent Transfer Service (BITS) is a low-bandwidth, asynchronous file transfer mechanism exposed through Component Object Model (COM).

Detect it with
BITS runs as a service and its status can be checked with the Sc query utility ( sc query bits ). Active BITS tasks can be enumerated using the BITSAdmin tool ( bitsadmin /list /allusers /verbose ).

Adversaries may use traffic signaling to hide open ports or other malicious functionality used for persistence or command and control.

Detect it with
Record network packets sent to and from the system, looking for extraneous packets that do not belong to established flows. The Wake-on-LAN magic packet consists of 6 bytes of FF followed by sixteen repetitions of the target system's IEEE address.

Web shells, IIS modules, and SQL stored procedures planted inside legitimate server software.

Detect it with
New .aspx/.php files in web roots; web server processes spawning shells; file integrity monitoring on web directories.

Adversaries may implant cloud or container images with malicious code to establish persistence after gaining access to an environment.

Detect it with
Monitor interactions with images and containers by users to identify ones that are added or modified anomalously.

Adversaries may abuse Pre-OS Boot mechanisms as a way to establish persistence on a system. During the booting process of a computer, firmware and various startup services are loaded before the operating system.

Detect it with
Perform integrity checking on pre-OS boot mechanisms that can be manipulated for malicious purposes. Take snapshots of boot records and firmware and compare against known good images.

Windows services, launch daemons, and systemd units created or hijacked for persistence.

Detect it with
Event ID 7045; new unit files in /etc/systemd/system; service binaries in unusual paths.

Adversaries may establish persistence and/or elevate privileges using system mechanisms that trigger execution based on specific events.

Detect it with
Monitoring for additions or modifications of mechanisms that could be used to trigger event-based execution, especially the addition of abnormal commands such as execution of unknown programs, opening network sockets, or reaching out across the network.

Run keys, startup folders, Winlogon helpers, and LSA drivers that execute on boot or logon.

Detect it with
Registry writes to Run/RunOnce by non-installer processes; new files in Startup folders.

Adversaries may modify host software binaries to establish persistent access to systems. Software binaries/executables provide a wide range of system commands or services, programs, and libraries.

Detect it with
Collect and analyze signing certificate metadata and check signature validity on software that executes within the environment. Look for changes to client software that do not correlate with known software or patch cycles.

Adversaries may modify authentication mechanisms and processes to access user credentials or enable otherwise unwarranted access to accounts.

Detect it with
Monitor for new, unfamiliar DLL files written to a domain controller and/or local computer.

Adversaries may execute their own malicious payloads by hijacking the way operating systems run programs. Hijacking execution flow can be for the purposes of persistence, since this hijacked execution may reoccur over time.

Detect it with
Monitor file systems for moving, renaming, replacing, or modifying DLLs. Changes in the set of DLLs that are loaded by a process (compared with past behavior) that do not correlate with known software, patches, etc., are suspicious.

Adversaries may impair a system's ability to hibernate, reboot, or shut down in order to extend access to infected machines. When a computer enters a dormant state, some or all software and hardware may cease to operate which can disrupt malicious activity.

Detect it with
Command-line invocation of tools capable of modifying services may be unusual and can be monitored for and alerted on, depending on how systems are typically used in a particular environment.

Adversaries who successfully compromise a system may attempt to maintain persistence by “closing the door” behind them – in other words, by preventing other threat actors from initially accessing or maintaining a foothold on the same system.

Detect it with
No MITRE detection guidance published. Build coverage from the parent technique and your own telemetry.

Adversaries may achieve persistence by leveraging OAuth application integrations in a software-as-a-service environment.

Detect it with
No MITRE detection guidance published. Build coverage from the parent technique and your own telemetry.