Mastering Malware Persistence Mechanisms
The stealth factor of malware increases significantly by achieving persistence on the infiltrated system. It allows the malware to continue its operations even after restarts, logoffs, reboots, etc., following a single injection/exploit. This chapter focuses solely on Windows due to its wide array of mechanisms facilitating persistence, such as Autostart. It encompasses the prevalent techniques for gaining persistence on a Windows machine, although it does not cover all of them.
In this chapter, we’re going to cover the following main topics:
- Classic path: registry Run Keys
- Leveraging registry keys utilized by Winlogon process
- Implementing DLL search order hijacking for persistence
- Exploiting Windows services for persistence
- Hunting for persistence: exploring non-trivial loopholes
- How to find new persistence tricks
