thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Security Operations · Intermediate

Persistence

Techniques attackers use to maintain access to a system across reboots, credential changes and other interruptions.

Definition

Common persistence methods include registry run keys, scheduled tasks, services, startup folders, WMI event subscriptions, cron jobs, new accounts, web shells and implants in firmware. Persistence is a distinct tactic (TA0003) in MITRE ATT&CK. Incident responders hunt for persistence to ensure complete eradication.

Example

An attacker creating a scheduled task named "GoogleUpdateTaskMachine" that launches a beacon at logon.

Exam tip

Autoruns and scheduled-task reviews are standard steps when checking for persistence.

Related terms