Persistence via Cobalt Strike

In Cobalt Strike, we can achieve persistence with the help of Aggressor Scripts. We have already learned about Aggressor Scripts in previous chapters.

Some of the Aggressor Scripts are already available on GitHub; we will use the following one:

https://github.com/harleyQu1nn/AggressorScripts/tree/master/Persistence

Here, we download the scripts on our system and import them into our Cobalt Strike client through the script manager, as shown in the following screenshot:

In the preceding screenshot, we loaded Persistence_Menu. This script creates a new entry in the Beacon menu with all the scripts we downloaded. These scripts can be accessed by right-clicking on the host | Red Team | Persistence, as shown in the following screenshot:

Let's look at the following example. Here, we will use HKCU Run Registry PowerShell Persistence (User Level)...