Persistence Techniques Guide: Run Keys, Scheduled Tasks and Implants

Attackers rarely rely on a single foothold: they plant autostart entries, services, scheduled jobs, web shells and spare credentials so that a reboot, a patch or a password reset does not lock them out. Incident response that removes the obvious malware but misses one of these mechanisms ends with the same intruder back within days. This guide maps the main persistence mechanisms on Windows, Linux, macOS and servers to MITRE ATT&CK v20, then covers how to prevent them, how to baseline and hunt for them, and how to evict an intruder cleanly. It is for detection engineers, incident responders and endpoint and server administrators, and it treats identity persistence (accounts, keys and tokens) as part of the same problem.

Key takeaways

• Persistence lives in a finite set of places. Registry autostart keys, services, scheduled tasks, WMI subscriptions, shell profiles, unit files and web roots can be enumerated and baselined, so unexplained change is detectable.
• Baseline, then diff. A signed, hashed autostart inventory per build, compared against every host, finds more persistence than chasing individual indicators.
• Identity persistence outlives host clean-up. Added cloud credentials, SSH authorised keys, new accounts and rogue federation trusts survive a rebuild, so credential rotation belongs in every eviction.
• Prevention is mostly about write access. Application control, removing local admin rights, LSA protection, Secure Boot and locked-down web directories stop most mechanisms from being installed at all.
• Evict everything at once. Scope all mechanisms first, then remove them and rotate credentials in one coordinated window; piecemeal removal warns the attacker.

How persistence works, and what changed in ATT&CK v20

ATT&CK's Persistence tactic (TA0003) covers techniques "that adversaries use to keep access to systems across restarts, changed credentials, and other interruptions". Mechanisms fall into four families: something that runs at boot or logon (Boot or Logon Autostart Execution T1547, Boot or Logon Initialization Scripts T1037, Create or Modify System Process T1543, Scheduled Task/Job T1053), something that runs when an event fires (Event Triggered Execution T1546), a modified server component that answers requests (T1505), and an identity the attacker can sign in with later. Many also give privilege escalation, because a service or task configured by an administrator runs as SYSTEM or root.

Two v20 details matter for mapping. Hijack Execution Flow (T1574), which covers DLL search order hijacking and side-loading (now one sub-technique, T1574.001 DLL), path interception by PATH environment variable, search order hijacking and unquoted path (T1574.007 to .009), services file and registry permissions weaknesses (T1574.010, .011), COR_PROFILER and AppDomainManager, is listed under Stealth (TA0005) and Execution (TA0002), not Persistence, although it is still used to persist. Modify Registry (T1112) now appears under Persistence. Detection content built on older matrices should be re-mapped rather than assumed current.

Windows persistence mechanisms

The table covers the Windows mechanisms seen most often in incident response, with the location to inspect and the telemetry that records a change.

The T1053.005 entry notes that attackers with SYSTEM rights can hide a task from schtasks /query and Task Scheduler by deleting its Security Descriptor (SD) registry value, so registry deletions under TaskCache\Tree deserve an alert of their own.

Linux and macOS persistence mechanisms

Configuration management (Ansible, Puppet, Chef or image pipelines) is the Linux equivalent of a baseline: anything in these paths that the pipeline did not put there is suspect. For hosts without EDR, auditd watch rules on cron, systemd, profile and ld.so.preload paths give a minimum signal.

Server, application and firmware implants

• Web shells (T1505.003): a script in a web root, such as the China Chopper family, gives remote command execution. NSA and ASD's guidance is that the best detection is comparing production against "a verified benign version" of the site, because shells are easy to modify and timestamps can be altered; alert when w3wp.exe, httpd or nginx spawn cmd.exe, powershell.exe, bash or curl. The Defender ASR rule "Block Webshell creation for Servers" (a8f5898e-1dc8-49a9-9878-85004b8a61e6) applies only to Exchange servers on Windows Server 2016 and 2019.
• Server components: IIS modules (T1505.004), Exchange transport agents (T1505.002), Terminal Services DLL (T1505.005), SQL stored procedures (T1505.001) and vSphere Installation Bundles (T1505.006) persist inside trusted services. Inventory each against vendor defaults.
• Compromised host software binaries (T1554): attackers replace or patch trusted executables. Code integrity policies and hash monitoring of system and application directories catch replaced binaries.
• Pre-OS boot (T1542.001 System Firmware, T1542.003 Bootkit): UEFI implants survive disk wipes. Secure Boot, measured boot with TPM attestation and vendor firmware updates are the controls; a reimage does not remove them.

Where identity fits

The most durable persistence is a credential. ATT&CK lists Account Manipulation (T1098) with sub-techniques for Additional Cloud Credentials (.001), Additional Email Delegate Permissions (.002), SSH Authorized Keys (.004) and Device Registration (.005), alongside Create Account (T1136), Valid Accounts (T1078), Modify Authentication Process (T1556) and Cloud Application Integration (T1671). Non-human identities are favoured because nobody notices a new secret on a service principal or a key on a service account. In the Storm-0501 hybrid cloud attacks, Microsoft reported that the group added a rogue federated domain to the victim's tenant and installed remote management tools on-premises, persistence that host clean-up alone would not remove. Alert on credentials added to applications, new federation trusts, new mailbox delegates and forwarding rules, and new privileged group members (Security 4720 for local or domain account creation). See the SaaS and OAuth App Governance Guide and the Service Account Security Guide.

Preventing persistence

• Remove the write access: most HKLM keys, services, system tasks and system directories need administrator rights. Removing standing local admin rights blocks the machine-wide mechanisms and leaves only per-user ones. See the Endpoint Privilege Management Guide.
• Application control: App Control for Business or AppLocker policies that block execution from user-writable paths such as %AppData% and %Temp% defeat per-user Run keys, startup folder payloads and COM hijacks that point at user directories. See the Application Allowlisting Guide.
• ASR rules: "Block persistence through WMI event subscription" (e6db77e5-3df2-4cf1-b95a-636979351e5b) needs Windows 10 1903 or Windows Server 2019 and later; Microsoft advises extensive audit-mode testing first because the Configuration Manager client relies heavily on WMI.
• Protect LSASS and the boot chain: LSA protection (RunAsPPL) blocks unsigned authentication packages and security support providers from loading into LSASS; Secure Boot disables AppInit DLLs and protects against bootkits.
• Close hijack opportunities: keep Safe DLL Search Mode on, quote service paths containing spaces, and fix weak permissions on service binaries and registry keys. ATT&CK's Audit mitigation (M1047) for T1574 recommends finding unquoted paths and stale registry keys.
• Lock down web roots: NSA and ASD advise that web applications should not be able to write to web-accessible directories; where that is not possible, use file integrity monitoring.

Detection, baselining and hunting

Real-time detection and periodic sweeps complement each other: events catch new persistence as it lands, sweeps catch what was installed before logging was in place.

• Real-time: collect Sysmon 12, 13 and 14 for autostart keys (Microsoft notes event 12 is "useful for monitoring for changes to Registry autostart locations"), 19 to 21 for WMI, 11 for startup folders and web roots, 7 for image loads and 6 for drivers, plus Security 4697, 4698, 4702 and System 7045. See the Windows Event Log Guide.
• Sweeps: Sysinternals Autoruns covers logon entries, services, drivers, scheduled tasks, WMI entries, image hijacks, AppInit DLLs and Winlogon notifications. Run autorunsc with -a * (all), -h (hashes), -s (verify signatures), -c (CSV) and the user argument * (all profiles), then hide signed Microsoft entries and compare against a golden-image baseline. EDR platforms offer equivalent autostart inventories at scale.
• Stacking: across a fleet, count each autostart entry by path and hash. Entries on one or two hosts out of thousands, unsigned binaries and paths in user profiles or ProgramData are the first to review.

Metrics that show coverage and control:

• Baseline coverage: percentage of hosts with an autostart inventory collected in the last 7 days.
• Unexplained entries: count of unsigned or rare autostart entries without an owner, trending down.
• Telemetry health: percentage of servers forwarding Sysmon registry, WMI and service events.
• Prevention reach: percentage of endpoints with the WMI persistence ASR rule in block mode and no standing local admin.
• Identity drift: new credentials added to applications and service principals per month that were not raised through change control (target zero).

Choosing a detection approach

No single tool sees every mechanism, so most teams combine two or three of these.

Cover the cheapest mechanisms to install first: Run keys and startup folders (T1547.001), scheduled tasks (T1053.005), services (T1543.003), WMI subscriptions (T1546.003), web shells and added credentials. Then extend to per-user COM hijacks, which need no administrator rights, and to LSA, shim and system DLL loader mechanisms, which need administrator rights but run inside trusted processes. Purple team tests should plant one benign entry per mechanism and confirm which tool alerted.

Evicting persistence during incident response

1. Scope before acting: sweep every host the attacker touched for all mechanisms in the tables above, and review identity changes in the directory and cloud tenants for the whole intrusion window.
2. Decide clean or rebuild: rebuild from a known-good image when kernel modules, firmware, system binaries or security tooling were tampered with, or when the scope is uncertain; targeted removal is reasonable only for well-understood, user-level mechanisms.
3. Coordinate one eviction window: remove mechanisms, block attacker infrastructure, and rotate passwords, keys, tokens and machine secrets together, so the attacker cannot re-enter through a path you have not yet closed.
4. Rotate server secrets: secrets read from a compromised host stay valid after patching. In the ToolShell SharePoint exploitation, a web shell stole ASP.NET machine keys, and Microsoft said it was "critical that customers rotate SharePoint server ASP.NET machine keys and restart IIS".
5. Watch for return: keep heightened alerting on the same mechanisms and identities for at least 30 days.

Small organisations without a dedicated team should favour rebuilding affected hosts and resetting all privileged credentials, because a missed mechanism costs more than a reimage. Large organisations need fleet-wide autostart stacking and an identity sweep across every tenant, since manual review does not scale. See the Incident Response Guide and the Leaked Credential Response Playbook.

Implementation: a phased rollout

1. Inventory: collect Autoruns or EDR autostart data from a sample of each build and record the approved baseline with hashes and signers.
2. Telemetry: deploy Sysmon with registry, WMI, file and image load events scoped to autostart paths, and enable 4698, 4702 and 4697 auditing.
3. Audit-mode prevention: put the WMI persistence ASR rule and application control in audit for two to four weeks and review what legitimate software would be blocked.
4. Pilot rings: enforce on IT devices, then 5-10% of business devices, then servers by role. The rollback is to return the policy to audit mode through Intune or Group Policy, never to remove the rule.
5. Linux and macOS: add auditd or EDR watches on cron, systemd, profile and launchd paths, and route changes outside configuration management to the SOC.
6. Identity: alert on new application credentials, federation changes, mailbox rules and SSH key additions.
7. Maintain: re-baseline after each build or major software change, retire approved entries that are no longer needed, and run the per-mechanism purple team test each quarter.

Common failure patterns

• Removing the malware, not the mechanism: the payload is deleted but the scheduled task or WMI subscription that relaunches it remains.
• Patching instead of rotating: the vulnerability is closed but keys, tokens and passwords taken during the intrusion still work, as the ToolShell machine key thefts showed.
• Credentials left unrotated after a related incident: in the Cloudflare Thanksgiving breach, four credentials not rotated after the Okta compromise gave a nation-state attacker a way in.
• Allowlisting signed binaries without context: legitimate RMM tools and signed loaders are installed as persistence and pass every signature check.
• Per-user locations ignored: sweeps run as SYSTEM and miss HKCU keys, user startup folders and COM overrides in other profiles.
• Telemetry on workstations only: web servers and Linux hosts, where web shells and cron jobs live, send no file or process events.

Framework mapping

Practitioner checklist

• Record an autostart baseline per build, with hashes and signers, and diff hosts against it weekly.
• Collect Sysmon 12/13/14, 19-21, 11, 7 and 6 plus 4697, 4698, 4702 and 7045 from servers and workstations.
• Alert on registry deletions under TaskCache\Tree and any write to /etc/ld.so.preload.
• Enable the WMI persistence ASR rule after audit testing, and LSA protection on all Windows hosts.
• Block execution from user-writable paths with application control.
• Monitor web roots against a known-good copy and alert on web server processes spawning shells.
• Alert on new application credentials, federation trusts, mailbox rules and SSH authorised keys.
• During eviction, remove all mechanisms and rotate credentials in one coordinated window.

Standards and references

• MITRE ATT&CK: Persistence (TA0003)
• MITRE ATT&CK: Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder (T1547.001)
• MITRE ATT&CK: Event Triggered Execution: Windows Management Instrumentation Event Subscription (T1546.003)
• MITRE ATT&CK: Hijack Execution Flow (T1574)
• NSA and ASD: Detect and Prevent Web Shell Malware
• Microsoft Learn: Attack surface reduction rules reference
• Microsoft Learn: Autoruns for Windows
• Microsoft Learn: Sysmon

Related NHI Mgmt Group resources: Incident Response Guide · Digital Forensics (DFIR) Guide · EDR Evasion and Defence Guide · Malware Guide · Service Account Security Guide