🔒MITRE ATT&CK: Tactic TA0003 — Persistence Explained

Persistence (TA0003) is the set of techniques adversaries use to keep access to systems across reboots, password changes, or other interruptions that might otherwise kick them out. In short: persistence is how attackers make sure they can come back later — even if you clean up the initial foothold.

Why it matters: if an adversary successfully implements persistence, they can return after patching, rebooting, or credential rotation — giving time to escalate privileges, move laterally, and achieve their objectives.

🧭 High-level objective

Keep a foothold so the adversary can operate over time — survive reboots, credential resets, and defensive actions.

🧩 Key Persistence Techniques (selected, high-value list)

Below are the most common and impactful Persistence techniques defenders see in the wild. (MITRE lists many sub-techniques; this is the practical, SOC-focused subset you’ll want to detect and mitigate first.)

• Boot or Logon Autostart Execution (T1547) — adding entries so malware runs at boot or user logon (registry Run keys, Startup folder, services).

  • Sub-examples: Registry Run Keys/Startup Folder (T1547.001), Scheduled Task/Job (T1053).

• Create or Modify System Process / Services (T1543) — install or modify services to start malicious payloads automatically.

• Scheduled Task / Job (T1053) — using cron or Windows Task Scheduler to run payloads on a schedule or at system events.

• Valid Accounts (T1078) & Create Account (T1136) — create or reuse valid user/service accounts so access looks legitimate.

• Account Manipulation (T1098) — change account properties (passwords, tokens) to retain access.

• DLL Search Order Hijacking / DLL Side-Loading (T1036.005 / related) — place malicious DLLs where the OS or app will load them automatically.

• Web Shells (T1505.003 / Web Shells variant) — persistent code uploaded to a web server so attackers can reconnect.

• Event Triggered Execution (T1546) — use file system or OS events to kick off code execution (e.g., WMI Event subscriptions, service triggers).

• Firmware / Bootkits (various) — implanting persistence below the OS (firmware, UEFI); high impact and hard to detect.

• External Remote Services / Remote Access (T1133 / T1021 variants) — register remote management tools or leave RATs that reconnect automatically.

• Container & Cloud persistence — storing backdoors as container images, cloud functions, or IAM principals (in cloud environments).

Note: MITRE documents many sub-techniques and variants; the exact list evolves as new persistence methods appear. For authoritative technique IDs and subtechniques, check the ATT&CK entry for Persistence.

⚠️ Real-world example (common playbook)

1. Initial access via phishing (user opens malicious Office doc).

2. Macro executes a staged payload and spawns PowerShell.

3. Payload creates a scheduled task (T1053) pointing to a launcher script plus adds a registry Run key (T1547.001).

4. Attacker creates a low-privilege service account (T1136) and configures it for long-lived use. Result: the attacker returns after reboots, re-establishes C2, and later escalates. (Common across many ransomware and APT operations.)
   

🔎 Detection Recommendations (concrete + practical)

Focus on anomalies and artifacts of persistence — not just file hashes.

1. Monitor autostart locations

   • Watch registry Run keys, Services, Startup folders, scheduled tasks. Alert on new/modified entries that reference unusual locations (e.g., temp folders, user profiles).

2. Log command and script activity

   • Enable PowerShell Script Block Logging & Module Logging; capture command-line for wscript/cscript, cmd.exe, powershell.exe. Look for encoded commands, download-and-execute patterns, or parent/child mismatches (e.g., Word -> powershell).

3. Detect abnormal account activity

   • Alert on account creation, changes to account privileges, long-lived service accounts, and simultaneous logins from disparate geolocations (use UEBA).

4. Process ancestry & code-signing checks

   • Flag processes spawned by uncommon parents (explorer spawning cmd/powershell from an Office app). Validate signatures where practical.

5. File integrity & unexpected module loads

   • Monitor DLL loads, especially when apps load unsigned or unexpected DLLs (DLL search order hijacking). Detect new files in system directories or webroot locations (web shells).

6. EDR/Telemetry for persistence artifacts

   • Use EDR to detect registry autoruns, service creation, scheduled tasks changes, WMI event consumers/subscriptions, and UEFI/firmware changes.

7. Hunt using artifact lists & Sigma rules

   • Use curated detection content (Sigma, YARA, Sigma rules for scheduled tasks, registry run keys, service changes) and regularly run hunts across endpoints and servers.
     

🛡️ Prevention & Hardening (prioritized)

1. Least privilege & account hygiene

   • Remove local admin rights from users. Use just-in-time (JIT) elevation and strong separation of service and user accounts. Require MFA for all interactive accounts.

2. Application allow-listing

   • Prevent unknown binaries and scripts from running; only allow approved executables and signed scripts.

3. Disable unnecessary autorun mechanisms

   • If you don't need macros, scheduled tasks, or certain service installations, disable or heavily restrict them. Block Office macros from the internet by default.

4. Harden OS & platform configurations

   • Enforce secure boot, firmware updates, restrict firmware flashing, and protect boot configuration to reduce firmware/bootkit persistence risk.

5. Segment & limit service deployment channels

   • Restrict use of software deployment frameworks (SCCM/Intune/etc.) and require strict signing, authentication, and auditing for deployment operations (to prevent attacker use of legitimate deployment channels).

6. Secure web servers & apps

   • Protect upload paths, validate/scan web uploads, and monitor for webshells. Run web apps with least privilege and isolate them.

7. Patch & reduce attack surface

   • Timely patching reduces exploitation avenues that attackers use to drop persistent backdoors (e.g., exploiting vulnerable services to install persistence).

8. Backup & recovery planning

   • Keep offline/immutable backups and test restorations — persistence may survive many remediation attempts if backups are not clean or immutable.
     

🧪 Incident Response playbook (short)

• Contain: Isolate impacted systems and accounts.

• Hunt: Identify all persistence artifacts (autoruns, services, scheduled tasks, new accounts, web shells).

• Evict: Remove persistence mechanisms and rotate credentials & secrets.

• Validate: Re-image hosts when firmware/bootkits suspected; verify backups and rebuild from trusted images.

• Lessons: Map root cause => harden the affected vector (e.g., patch exploited app, remove insecure deployment channel).(Approach and artifacts to hunt are described across ATT&CK technique pages.)
  

✅ Quick checklist (SOC friendly)

•  Log and monitor autostart areas (Registry, Services, Startup, Task Scheduler).

•  Enable PowerShell and script logging; ingest to SIEM.

•  Alert on new/modified accounts and privilege changes.

•  Implement application allow-listing and block unsigned code.

•  Harden firmware/UEFI and require secure boot where available.

•  Maintain and test offline/immutable backups.

•  Regularly run persistence hunts (Sigma rules / EDR queries).
  

Final thoughts

Persistence is the attacker’s insurance policy — it’s what lets them survive defenses, cleanup, and routine maintenance. The best defense is a combination of strong preventative controls (least privilege, whitelisting, secure configuration), rich telemetry (script logging, EDR), and proactive hunting for persistence artifacts. Treat persistence as a first-class threat: if you can detect and remove persistence early, you interrupt the adversary’s ability to return and escalate.