Maintaining persistent access on Windows systems
As you already know, the process of getting a foothold on a system is often accompanied by privilege escalation, defense evasion, or credential access. The techniques used to achieve these goals have quite a lot of overlap and, as a result, similar methods of analysis.
The sources where you can find traces of the techniques used can be divided into several main groups:
- Event logs
- Registry
- Filesystem metafiles
- Other sources
Let’s look at ways to analyze each of the preceding groups and the corresponding traces of the techniques of persistence, defense evasion, privilege escalation, and credential access.
Event logs
Windows event logs are one of the sources that can help you find traces of persistence. Event logs can store data about a new service installed on a system, information about creating, enabling, or modifying user accounts, new scheduled tasks, and Background Intelligent Transfer Service...
