An incident is not over when the first foothold is removed, because Persistence (TA0003) is the set of techniques attackers use to make sure they can come back. ATT&CK v20 describes the tactic as the adversary "trying to maintain their foothold", keeping access across restarts, changed credentials and other interruptions by changing access, actions or configuration. With 113 current techniques and sub-techniques it is the largest tactic in Enterprise ATT&CK, and it splits cleanly into two planes: host persistence (services, run keys, scheduled tasks, web shells) and identity persistence (accounts, credentials added to applications, consent grants, changes to the authentication process). This hub compares the two, ranks where to start, sets out detection and mitigation priorities and links every technique guide. It is for incident responders, detection engineers and identity administrators.
Key takeaways
- Procedure data is dominated by host persistence. Registry Run Keys / Startup Folder (T1547.001) has 267 recorded uses in v20, Scheduled Task (T1053.005) 193, Modify Registry (T1112) 175 and Windows Service (T1543.003) 141, mostly from malware families.
- Identity persistence is what survives a rebuild. Credentials added to an application, a new cloud account, a consent grant or a forged token keep working after every endpoint is reimaged, and they are the pattern in the cloud breaches on nhimg.org.
- Containment means revoking, not only cleaning. Removing malware without rotating credentials, reviewing app registrations and revoking tokens leaves the identity footholds in place.
- Privileged access is the strongest single control. Privileged Account Management (M1026) mitigates 37 Persistence entries and User Account Management (M1018) 32: most persistence needs administrative rights to install.
- Some of the most used techniques have no listed mitigation. v20 lists no mitigations for T1547 or T1547.001, so autostart persistence must be caught by detection and baselining.
What Persistence means in practice
Persistence answers one question for the attacker: if the session drops, the password changes or the host reboots, how do I get back in? The answer can live in three places, and each needs a different response.
- On the host: code that runs automatically at boot, logon, on a schedule or on an event (T1547, T1053, T1543, T1546, T1037), or inside server software (T1505, including web shells). Cleaned by removal or reimage.
- In the identity plane: a valid or newly created account (T1078, T1136), extra credentials, roles, delegates or SSH keys on an existing one (T1098), a changed authentication process (T1556), or a third-party integration (T1671). Survives reimage; cleaned by revocation, rotation and configuration review.
- Below the operating system or in the supply of software: firmware and bootkits (T1542), modified host binaries (T1554), implanted container images (T1525). Requires integrity verification and often hardware or image replacement.
Persistence normally follows Initial Access or Privilege Escalation. See the ATT&CK Initial Access Tactic for the entry side and the ATT&CK Credential Access Tactic Guide for how attackers collect the credentials they later reuse.
Identity persistence versus host persistence
Summing recorded uses by technique family in the Enterprise ATT&CK v20 dataset ("uses" relationships from groups, software and campaigns, revoked and deprecated objects excluded) gives about 1,240 uses for host and below-OS families and about 330 for the identity families (T1078, T1136, T1098, T1133, T1556, T1671). The gap reflects the data: ATT&CK procedure examples come largely from malware analysis, which documents host mechanisms in detail. Cloud and SaaS breach reports tell a different story.
| Aspect | Host persistence | Identity persistence |
|---|---|---|
| Typical techniques | T1547 autostart, T1053 scheduled tasks, T1543 services, T1546 event triggers, T1505.003 web shells | T1078 valid accounts, T1098 account manipulation, T1136 create account, T1556 modify authentication, T1671 cloud application integration |
| Where it lives | Registry, file system, service control manager, cron and systemd, web roots | Directory and IdP objects, app registrations and service principals, OAuth grants, IAM users and keys, MFA registrations |
| Main evidence | Windows Security 4697, 4698; Sysmon 1, 12, 13, 14; auditd writes to systemd and cron paths; launchd plist changes | Windows 4720, 4738, 4728; Entra ID and Okta audit logs; CloudTrail CreateUser, CreateAccessKey; Microsoft 365 consent events |
| Survives reimage | No (except firmware and implanted images) | Yes |
| Survives password reset of the compromised user | Yes | Often yes: added keys, app secrets, tokens and other accounts are unaffected |
| Who owns removal | Endpoint and server teams | Identity, cloud and SaaS administrators |
Where identity fits
Non-human identities are a favoured persistence store because they are rarely reviewed, often hold broad permissions and do not prompt for MFA. Adding a secret or certificate to an existing service principal (T1098.001), granting an application a mailbox role, or keeping a forgotten service token all give access that looks like normal automation. The controls are an inventory of every app registration, service principal, access key and OAuth grant with an owner; alerts on any new credential added to an existing application; short credential lifetimes; and a containment runbook that rotates machine credentials as well as user passwords. See the MITRE ATT&CK T1098.001 Account Manipulation guide.
Where to start: ranked techniques
| Rank | Technique | Why it is first | Highest-value check |
|---|---|---|---|
| 1 | T1098 Account Manipulation (incl. T1098.001 Additional Cloud Credentials, T1098.003 Additional Cloud Roles) | Turns one compromise into durable access that survives user password resets; central to the cloud cases below | Alert on credentials added to existing applications and on new privileged role assignments |
| 2 | T1078 Valid Accounts and T1136 Create Account | Hardest to tell apart from legitimate use; unrotated credentials keep attackers in after response | Alert on account creation outside the provisioning system; rotate all credentials in scope after an incident |
| 3 | T1505.003 Web Shell | 67 recorded uses; the standard persistence after edge and web exploitation | Web server processes spawning shells; file integrity on web roots |
| 4 | T1547.001 Run Keys / Startup Folder, T1053.005 Scheduled Task, T1543.003 Windows Service | The bulk of malware persistence on Windows | Baseline autoruns, scheduled tasks (4698) and service installs (4697); alert on new entries pointing to user-writable paths |
| 5 | T1556 Modify Authentication Process and T1671 Cloud Application Integration | Rare but severe: changes how everyone authenticates or plants a permanent integration | Alert on federation, conditional access and authentication policy changes and on new high-privilege consents |
Attack chains from real cases
- New OAuth apps and a consenting account: in the Microsoft Midnight Blizzard breach, a password spray against a legacy test tenant account without MFA led to a legacy test OAuth application with elevated access. Microsoft reported that the actor created additional malicious OAuth applications and a new user account used to grant consent to them, and granted the Exchange Online full_access_as_app role. That is T1136 and T1098 working together in the identity plane.
- Credentials added to service principals: in the SolarWinds compromise, attackers added illegitimate credentials to existing application service principals that already had Microsoft Graph mail access (T1098.001), and in selected victims stole the SAML token-signing certificate to forge tokens (T1606.002 SAML Tokens, a Credential Access technique).
- Unrotated machine credentials as the way back: in the Cloudflare breach, one service token and three service accounts were not rotated after the October 2023 Okta breach because they were believed unused. An attacker used them in November 2023, then established persistence on the Atlassian server through ScriptRunner for Jira. Cloudflare's response rotated more than 5,000 production credentials.
- Web shells and appliance persistence: after the Ivanti Connect Secure exploitation, a web shell was installed on an affected device at CISA (T1505.003), and CISA warned that root-level persistence could survive factory resets.
The lesson across all four: eviction failed or nearly failed where response focused on hosts and the attacker's identity footholds were not enumerated.
Detection priorities across the tactic
ATT&CK v20 detection strategies for the highest-priority families name the following events. Build identity detections first, because they are fewer, high-signal and cover persistence that host tools never see.
| Family | What to alert on | Log sources named in v20 analytics |
|---|---|---|
| T1098 Account Manipulation | Account changes, group and role additions, credential and permission changes on accounts and applications | Windows Security 4738, 4728, 4670; Okta role assignment changes; Microsoft 365 admin role changes; ESXi account creation; auditd usermod and /etc/passwd writes |
| T1136 Create Account | Accounts created outside the joiner process or by unusual principals | Windows 4720; Entra ID "Add user"; CloudTrail CreateUser and AttachUserPolicy; auditd useradd |
| T1556 Modify Authentication Process | Authentication policy, password policy and authentication package changes | Windows 4657 and Sysmon 7 and 10; Azure policy updates; CloudTrail UpdateLoginProfile and UpdateAccountPasswordPolicy |
| T1671 Cloud Application Integration | Consent by privileged or unexpected accounts; integrations persisting after the consenting user is disabled | Microsoft 365 app role assignment and consent events; SaaS integration audit logs |
| T1505 Server Software Component | Web server or database processes spawning interpreters; new modules or plug-ins; outbound connections from server binaries | Sysmon 1; auditd execve; ESXi hostd extension installs |
| T1547, T1543, T1053 | New autostart, service and scheduled task entries, especially pointing to user-writable or temporary paths | Windows 4697, 4698, 4688; Sysmon 1, 2, 13, 14; auditd writes to systemd and cron paths; launchd plist loads |
Persistence is unusually suited to state comparison as well as event alerting. A weekly diff of autoruns, services, scheduled tasks, cron entries, local administrators, app registration credentials, OAuth grants and IAM keys against a known-good baseline catches entries whose creation events were missed or aged out of the SIEM.
Mitigation priorities
Counting "mitigates" relationships for the 113 entries in v20 shows that a few controls cover a large part of the tactic. See the ATT&CK Mitigations hub for each.
| Mitigation | Persistence entries mitigated (of 113) | Practical meaning |
|---|---|---|
| M1026 Privileged Account Management | 37 | Few standing administrators; separate admin accounts; just-in-time elevation, so installing persistence requires an auditable step |
| M1018 User Account Management | 32 | Restrict who can create accounts, register applications, add credentials and grant consent |
| M1047 Audit | 27 | Regular review of autoruns, services, accounts, app credentials and grants |
| M1032 Multi-factor Authentication | 22 | Raises the bar for reusing valid accounts and for remote services |
| M1022 Restrict File and Directory Permissions | 18 | Prevent standard users writing to service, startup and web root paths |
| M1028 Operating System Configuration and M1042 Disable or Remove Feature or Program | 14 each | Remove unused autostart mechanisms, script hosts and services |
| M1038 Execution Prevention and M1045 Code Signing | 12 and 11 | Application control so that a planted binary cannot run |
Eviction and implementation roadmap
- Baseline both planes. Export current autoruns, services, scheduled tasks and cron on servers and endpoints, and current accounts, admin role holders, app registrations with their credentials, service principals, OAuth grants and access keys in each tenant and cloud account.
- Turn on the events. Enable Windows auditing for account management and for service and scheduled task creation, deploy Sysmon or EDR registry monitoring, and forward IdP audit logs, CloudTrail management events and Microsoft 365 consent events to the SIEM.
- Restrict who can create footholds. Limit application registration and user consent, require admin approval for high-privilege scopes, and restrict who can add credentials to applications.
- Write detections in the priority order above, test each with a benign change in a pilot environment (for example, add a test secret to a test app registration), and confirm the alert fires.
- Prepare the eviction runbook. For a confirmed intrusion, enumerate both planes, remove host persistence, then in a coordinated window revoke sessions and refresh tokens, rotate machine and user credentials in scope, remove unknown app credentials and grants, and verify. Rolling back means restoring a known-good configuration from the baseline, not re-enabling removed items piecemeal.
Small and large organisations
Smaller organisations with mostly SaaS and managed endpoints should prioritise steps 1 to 3 in the identity plane and rely on EDR for host persistence. Larger estates need scheduled baseline diffs across thousands of hosts and many tenants, and an eviction runbook rehearsed with the identity, cloud and endpoint teams together.
Measuring coverage
- Identity baseline coverage: percentage of tenants and cloud accounts with a current inventory of app credentials, grants and access keys.
- Unowned application credentials: count of app registration secrets and certificates with no named owner, trending to zero.
- Time to detect a new app credential: minutes from a test secret being added to an alert.
- Autorun drift: number of unexplained autostart, service and scheduled task changes per week on servers.
- Post-incident rotation completeness: share of in-scope credentials (user and machine) rotated within the eviction window.
Common failure patterns
- Reimaging without revoking: hosts are rebuilt but app secrets, OAuth grants and new accounts are left, so the attacker returns through the identity plane.
- Rotating only human passwords: service tokens and service accounts believed unused are skipped, as in the Cloudflare case.
- Test and legacy tenants out of scope: non-production identities with production reach are not monitored or baselined.
- Unrestricted application consent: any user can grant a third-party app durable access to their data.
- Edge devices trusted after patching: a patched appliance can still carry a web shell or deeper persistence; integrity verification and credential resets are needed.
- Alerting on events that are not logged: the Windows audit subcategories that record service installs (4697) and scheduled task creation (4698) are not enabled by default, so rules never fire.
Every technique in the tactic
All 22 parent techniques with Persistence in Enterprise ATT&CK v20 and their sub-techniques (113 entries in total), with recorded uses summed across the family. Technique guides are linked where they exist.
| ID and name | Sub-techniques | v20 uses (family) | Guide |
|---|---|---|---|
| T1037 Boot or Logon Initialization Scripts | .001 Logon Script (Windows), .002 Login Hook, .003 Network Logon Script, .004 RC Scripts, .005 Startup Items | 25 | MITRE ATT&CK T1037 Boot or Logon Initialization Scripts |
| T1053 Scheduled Task/Job | .002 At, .003 Cron, .005 Scheduled Task, .006 Systemd Timers, .007 Container Orchestration Job | 223 | T1053 Scheduled Task/Job Defensive Guide |
| T1078 Valid Accounts | .001 Default Accounts, .002 Domain Accounts, .003 Local Accounts, .004 Cloud Accounts | 158 | MITRE ATT&CK T1078 Valid Accounts Guide |
| T1098 Account Manipulation | .001 Additional Cloud Credentials, .002 Additional Email Delegate Permissions, .003 Additional Cloud Roles, .004 SSH Authorized Keys, .005 Device Registration, .006 Additional Container Cluster Roles, .007 Additional Local or Domain Groups | 47 | MITRE ATT&CK T1098 Account Manipulation Guide; MITRE ATT&CK T1098.001 Account Manipulation |
| T1112 Modify Registry | None | 175 | MITRE ATT&CK T1112 Modify Registry |
| T1133 External Remote Services | None | 43 | T1133 External Remote Services Defensive Guide |
| T1136 Create Account | .001 Local Account, .002 Domain Account, .003 Cloud Account | 51 | MITRE ATT&CK T1136 Create Account Guide |
| T1137 Office Application Startup | .001 Office Template Macros, .002 Office Test, .003 Outlook Forms, .004 Outlook Home Page, .005 Outlook Rules, .006 Add-ins | 16 | MITRE ATT&CK T1137 Office Application Startup |
| T1176 Software Extensions | .001 Browser Extensions, .002 IDE Extensions | 9 | MITRE ATT&CK T1176 Software Extensions |
| T1197 BITS Jobs | None | 13 | MITRE ATT&CK T1197 BITS Jobs |
| T1205 Traffic Signaling | .001 Port Knocking, .002 Socket Filters | 33 | MITRE ATT&CK T1205 Traffic Signaling |
| T1505 Server Software Component | .001 SQL Stored Procedures, .002 Transport Agent, .003 Web Shell, .004 IIS Components, .005 Terminal Services DLL, .006 vSphere Installation Bundles | 78 | T1505 Server Software Component Defensive Guide |
| T1525 Implant Internal Image | None | 0 | MITRE ATT&CK T1525 Implant Internal Image |
| T1542 Pre-OS Boot | .001 System Firmware, .002 Component Firmware, .003 Bootkit, .004 ROMMONkit, .005 TFTP Boot | 14 | None yet |
| T1543 Create or Modify System Process | .001 Launch Agent, .002 Systemd Service, .003 Windows Service, .004 Launch Daemon, .005 Container Service | 203 | T1543 Create or Modify System Process Defensive Guide |
| T1546 Event Triggered Execution | 18 sub-techniques (.001 to .018), including .003 WMI Event Subscription (25 uses) and .015 Component Object Model Hijacking (12 uses) | 82 | T1546 Event Triggered Execution Defensive Guide |
| T1547 Boot or Logon Autostart Execution | 14 sub-techniques, including .001 Registry Run Keys / Startup Folder (267 uses), .009 Shortcut Modification (29) and .004 Winlogon Helper DLL (13) | 339 | T1547 Boot or Logon Autostart Execution Defensive Guide |
| T1554 Compromise Host Software Binary | None | 25 | MITRE ATT&CK T1554 Compromise Host Software Binary |
| T1556 Modify Authentication Process | .001 Domain Controller Authentication, .002 Password Filter DLL, .003 Pluggable Authentication Modules, .004 Network Device Authentication, .005 Reversible Encryption, .006 Multi-Factor Authentication, .007 Hybrid Identity, .008 Network Provider DLL, .009 Conditional Access Policies | 26 | MITRE ATT&CK T1556 Modify Authentication Process Guide; MITRE ATT&CK T1556.001 Domain Controller Authentication |
| T1653 Power Settings | None | 3 | MITRE ATT&CK T1653 Power Settings |
| T1668 Exclusive Control | None | 0 | MITRE ATT&CK T1668 Exclusive Control |
| T1671 Cloud Application Integration | None | 1 | MITRE ATT&CK T1671 Cloud Application Integration |
Framework mapping
| Framework | Controls relevant to Persistence |
|---|---|
| NIST CSF 2.0 | PR.AA-01 identities and credentials managed; PR.PS-01 configuration management practices applied; DE.CM-09 computing hardware, software and runtime environments monitored |
| NIST SP 800-53 Rev. 5 | AC-2 Account Management; AC-6 Least Privilege; CM-3 Configuration Change Control; CM-7 Least Functionality; SI-7 Software, Firmware, and Information Integrity; AU-6 Audit Record Review, Analysis, and Reporting |
| CIS Controls v8.1 | Control 2 Inventory and Control of Software Assets; Control 4 Secure Configuration; Control 5 Account Management; Control 6 Access Control Management; Control 8 Audit Log Management |
Practitioner checklist
- Keep a baseline of autoruns, services, scheduled tasks and cron on servers, and diff it weekly.
- Inventory app registrations, service principals, access keys and OAuth grants, each with an owner.
- Alert on credentials added to existing applications and on new privileged role assignments.
- Alert on account creation outside the provisioning system, in every directory and cloud account.
- Restrict user consent and application registration; require admin approval for high-privilege scopes.
- Alert on authentication policy, federation and conditional access changes.
- Monitor web servers and appliances for interpreter child processes and web root changes.
- Include machine credentials, tokens and grants in every eviction and rotation plan.
- Bring test and legacy tenants into identity monitoring.
Standards and references
- MITRE ATT&CK: Persistence (TA0003)
- MITRE ATT&CK: Account Manipulation (T1098)
- MITRE ATT&CK: Boot or Logon Autostart Execution (T1547)
- MITRE ATT&CK: Server Software Component: Web Shell (T1505.003)
- MITRE ATT&CK: Modify Authentication Process (T1556)
- NIST: Cybersecurity Framework 2.0
- NIST: SP 800-53 Rev. 5
- CIS: CIS Controls v8.1
Related NHI Mgmt Group resources: MITRE ATT&CK Guide for Defenders · MITRE ATT&CK T1098 Account Manipulation Guide · OAuth Token Theft Incident Playbook · ATT&CK Mitigations