Persistence
في هذه الصفحة
Persistence answers: what will run again without anyone starting it?
At a glance
Question | What will run again without anyone starting it? |
Reads | Services, scheduled tasks, auto-start entries of the machine and every user, WMI subscriptions, BITS jobs - each from every place Windows keeps it, merged. |
Works best with | Security auditing of service installations (4697) and task changes (4698-4702); the Task Scheduler log enabled. |
Parameter |
|
Rule prefix |
|
What it reads
What | Where Signal reads it |
|---|---|
Services and drivers | The service table now ( |
Scheduled tasks | The TaskCache registry, the task's XML or |
Auto-start entries | Run keys, Winlogon, IFEO debuggers, AppInit, LSA packages, COM overrides, Startup folders, PowerShell profiles, Office add-ins and test key, netsh helpers, print monitors, time providers, Active Setup, screensavers, AMSI providers and more - for the machine and every user, including users not signed in (their hives are read from disk) ( |
WMI subscriptions |
|
BITS jobs | The Bits-Client log, merged per job ( |
Every program a configured entry runs is checked: its signature (offline, no network), its SHA-256, SHA-1 and MD5.
Signals it raises
31 rules: 1 critical, 15 high, 15 medium. The full text of each is in the rule catalog.
ID | Severity | Title | Evidence | ATT&CK |
|---|---|---|---|---|
| critical | An accessibility program is hijacked through its debugger |
|
|
| high | AppInit or AppCert DLLs are loaded into programs |
|
|
| high | BootExecute runs something besides autocheck |
|
|
| high | A user's COM class overrides the machine's with an unsigned DLL in a user folder |
|
|
| high | A user logon script is set in the user's Environment key |
|
|
| high | A non-default LSA package is loaded |
|
|
| high | The Office test key loads a DLL |
|
|
| high | A Run key starts a script host |
|
|
| high | A service runs a command shell or script host |
|
|
| high | A service runs from a user-writable folder |
|
|
| high | A netsh helper, print monitor, print processor or time provider loads an unusual DLL |
|
|
| high | A scheduled task is hidden from the Task Scheduler |
|
|
| high | A scheduled task runs a script host with a hidden or downloaded command |
|
|
| high | A scheduled task runs a program from a user-writable folder |
|
|
| high | Winlogon starts something other than Windows' own shell or Userinit |
|
|
| high | A WMI subscription runs a command or script |
|
|
| medium | An Active Setup component runs a program from a user-writable folder, or an unsigned one |
|
|
| medium | A BITS job transferred from a public IP address rather than a host name |
|
|
| medium | A BITS job was created by a shell, a script host or bitsadmin |
|
|
| medium | A program is started through another one's debugger or exit monitor |
|
|
| medium | An Office add-in loads an unsigned DLL from a user-writable folder |
|
|
| medium | A file is in Word's or Excel's startup folder |
|
|
| medium | A PowerShell profile runs for every user |
|
|
| medium | A Run key starts an unsigned program from a user-writable folder |
|
|
| medium | A user's screensaver is a program outside System32, or not validly signed |
|
|
| medium | A script is in a Startup folder |
|
|
| medium | A person's account registered a task that runs a program outside Program Files and System32 |
|
|
| medium | A legacy .job scheduled task exists |
|
|
| medium | A scheduled task is defined in the registry but not shown by the Task Scheduler |
|
|
| medium | A driver is not signed, or its signature does not verify |
|
|
| medium | A driver with a known vulnerability is installed |
|
|
How to read it
The persistence table lists every entry configured now, Windows' own left out (counted). Use it to stack hosts: an entry on one host of a thousand stands out.
A state and its creation are one signal. A service installed (7045) and still configured is one signal, the installation corroborated by the service table.
Who made it comes from the Security log (4697, 4698-4702) when those are audited; the System log's 7045 does not say.
persist.modifiedis a key's last write: a clue to when, not proof.
What it can't see
Try it yourself
The lab on your own machine creates a harmless scheduled task and watches PERSIST-TASK-USER-PATH fire.
Next
Logons: how the host was used, and from where.