Common Persistence Mechanisms
Registry Run Keys (T1547.001)
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce
Scheduled Tasks (T1053.005)
schtasks /create /tn "UpdateService" /tr "C:\malware.exe" /sc onlogon
Services (T1543.003)
sc create MalService binPath= "C:\malware.exe" start= auto
Startup Folder (T1547.001)
%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\
WMI Event Subscriptions (T1546.003)
Permanent event subscriptions that survive reboot.
DLL Search Order Hijacking (T1574.001)
Place malicious DLL in application directory before system directory.
COM Object Hijacking (T1546.015)
Register malicious COM objects to be loaded by legitimate software.
Detection Checklist
- Check all Run/RunOnce keys
- List scheduled tasks
- Enumerate services
- Check startup folders
- Query WMI subscriptions
- Audit recently modified COM registrations