Overview
Persistence indicators reveal how malware maintains a foothold across reboots. This lesson covers detecting persistence on endpoints.
Learning objectives
- Explain persistence and why attackers use it.
- Identify common persistence mechanisms and indicators.
- Connect persistence detection to eradication.
Core concept
Persistence is how malware or an attacker survives reboots and logoffs to maintain access — a common post-compromise goal (from the ethical-hacking path, here as a detection target). Persistence indicators are the artifacts these mechanisms leave: auto-start entries (registry run keys, startup folders), scheduled tasks/cron jobs, new or modified services/daemons, account creation, and modifications to legitimate auto-run locations. EDR telemetry captures the creation of these artifacts, making persistence detectable. Finding persistence indicators is important both for detection (an unexpected auto-start entry is a red flag) and for eradication — you can't fully remove a threat without removing its persistence, or it returns after a reboot. Persistence detection is a key part of endpoint investigation and response.
How it works
Attackers establish persistence so their malware/access restarts automatically — surviving reboots (otherwise a reboot would evict them). Common mechanisms/indicators (across operating systems): auto-start registry keys or startup folder entries, scheduled tasks / cron jobs that re-launch the payload, newly-created or modified services/daemons set to run at boot, new accounts (especially privileged), and hijacking of legitimate auto-run locations or configuration. EDR records the creation/modification of these artifacts, so an unexpected new auto-start entry, scheduled task, or service — especially one pointing to a suspicious executable or created in the same process chain as other malicious activity (process tree, lesson 2) — is a strong detection indicator. During investigation, the analyst identifies all persistence the threat established. This matters critically for eradication (module 15): removing the malware's active process but not its persistence means it returns on reboot — so thorough persistence removal is essential to fully evicting the threat. Persistence indicators thus serve both detection (spotting the foothold) and complete response (ensuring nothing remains to restart). They're the defensive view of the persistence techniques studied offensively in the ethical-hacking path.
Practical example
Investigating a compromised endpoint, the analyst hunts for persistence indicators and finds several: a scheduled task created to re-launch a payload at intervals, an auto-start registry entry pointing to the malware, and a newly-created service set to run at boot — all created within the same malicious process chain (visible in the process tree). Recognizing these, the analyst ensures eradication removes all of them, not just the running process — because leaving any one would let the malware return after reboot. Had they only killed the active process, the scheduled task would have restarted it. Identifying every persistence indicator was essential to fully evicting the threat.
Cybersecurity relevance
Persistence detection is essential to both detection and complete eradication: attackers use persistence (auto-start keys, scheduled tasks/cron, services/daemons, new accounts) to survive reboots, so an unexpected auto-start artifact is a strong detection indicator — and, critically, removing a threat's active process but not its persistence lets it return on reboot, so identifying all persistence is required for thorough eradication (module 15). EDR telemetry captures persistence-artifact creation, and process trees (lesson 2) link it to the attack chain. Persistence indicators are the defensive counterpart to the persistence techniques studied offensively in the ethical-hacking path — making persistence detection a key part of endpoint investigation and response.
Common mistakes
- Removing the active process but not its persistence, causing the threat to return on reboot.
- Missing persistence mechanisms (only checking one location rather than the common set).
- Not linking persistence artifacts to the attack chain (process tree) to find all of them.
Key takeaways
- Persistence is how malware/attackers survive reboots to maintain access; indicators include auto-start keys, startup entries, scheduled tasks/cron, new/modified services, and new accounts.
- EDR captures persistence-artifact creation, making it detectable; an unexpected auto-start artifact (especially in a malicious process chain) is a strong detection indicator.
- Identifying ALL persistence is essential for eradication — removing the process but not persistence lets the threat return; persistence detection is the defensive view of offensive persistence techniques.
Check your understanding
- What are common persistence mechanisms, and why do attackers use persistence?
- Why is identifying all persistence indicators critical for eradication?