How to find new persistence tricks

At first, it may just be some oddities that you may encounter and cannot explain (especially when you have little experience with reverse engineering), for example, with Internet Explorer. When you use Procmon a lot, some of the things you see in the logs eventually get stuck in your head and become really familiar. Eventually, I started analyzing the actual code that triggers this behavior; sometimes I just tried DLL hijacking. Of course, there are a lot of potentially vulnerable and potentially exploitable applications for persistence, but there are so many of them that it would require a separate book on this topic with examples.