Discovering persistence mechanisms

So far, we've discussed attacker methodologies, and have been watching for processes and dropped files created by our malware. While writing a malicious payload to disk and executing it is a great first step for an actor, it does not guarantee continued control of the host. For this, actors need a persistence mechanism – or a way to guarantee that the malware will execute each time the target is restarted.

Run keys

In Windows, one of the most common techniques for maintaining persistence is a built-in feature of the Windows Registry. The Windows Registry houses per-user and per-machine keys that can store file path values of binaries to run upon login or startup. The keys are as follows:

• HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
• HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce
• HKEY_CURRENT_USER\Software\Microsoft...