🖥️ Windows Persistence Techniques – Full Deep Dive

Cybersecurity security in Windows operating systems is not only measured against first-time attacks, but even more challenging is detecting and stopping the "Persistence," or long-lasting embedded techniques of attackers. After they can successfully break into the system, Persistence makes it possible for hackers to remain on the system even when the user restarts the machine, logs out, or even when an anti-virus program tries to remove a dangerous file.

The reason why priority should be given to this topic is because Persistence is one of the main techniques that the APT (Advanced Persistent Threats) group and advanced malware use to continuously store permissions and access the system. If it cannot be detected in a timely manner, the damage will be prolonged and exacerbated by time.

Secure Persistence refers to the ability of an intruder or malware to maintain long-term access to a target system despite rebooting, changing users, or attempting to delete dangerous files.

This concept is not new, but arises in tandem with the evolution of malware. For example,

Early (1990s-2000s): Malware is often embedded through the Registry Run Keys or the Startup folder.

Modern times: Malware and APT use more sophisticated techniques such as WMI Event Subscription, DLL Side-Loading or Bootkits.

Basics to know before understanding Persistence

Attack Lifecycle: Initial Access → Privilege Escalation → Persistence Setup → Cover Tracks

Privilege: Many ways of Persistence rely on high-level rights (Admin / SYSTEM).

Artefacts: Persistence often leaves traces, such as Key Registry, Services, or strange DLL files.

Main Contents

1.Registry Run Keys & Startup

Method: Add a Registry or file value in the Startup Folder so that it runs every time Windows starts.

Attack example:

REG add "HKCU\ Software\ Microsoft\ Windows\ CurrentVersion\ Run" / v OneDriveUpdate / t REG _ SZ / d "C:\ Users\ Public\ onedrv.exe"

It looks like OneDrive, but it's actually malware.

Case Study: Several Banking Trojan line malware, such as Zeus, use Run Keys to embedded

Advantage (Hacker): Easy to do. Use normal user permissions.

Disadvantages: Easy to detect with Autoruns or SIEM

2. Scheduled Tasks

Method: Create a Task to run the program when Logon or specified time.

Attack example:

schtasks / create / sc onlogon / tn "WindowsUpdate" / tr "C:\ malware.exe"

Case study: APT29 uses Scheduled Tasks to access bureaucracy

Advantage: Flexible, timer

Disadvantages: It can be verified by the schtasks / query command.

3.DLL Side-Loading

Method: Relying on the Windows DLL loading sequence by forging the DLL and then placing it in the program folder.

Attack example: App.exe needs abc.dll → hackers put fake abc.dll → Danger DLL loader instead

Case study: Lazarus group uses DLL Side-Loading in key infrastructure attack

Advantage: Difficult to detect. Use the actual program as the caller.

Disadvantages: Requires access to the target system file or program.

4.WMI Event Subscription

Method: Using WMI Trigger, run the code automatically.

Attack Example (PowerShell):

Filter=Set-WmiInstance $-Class _ _ EventFilter -Namespace "root\ subscription" -Arguments @ {name = "StartupTrigger"; EventNamespace = "root\ cimv2"; Query = "SELECT * FROM _ _ InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA 'Win32 _ PerfFormatedData _ PerfOS _ System'"}

Case Study: The FIN7 Group makes heavy use of WMI Persistence.

Advantages: Hide well. No need to create new files.

Disadvantages: Difficult to check. Specific tools required.

5. Service Modification

Method: Create or modify Windows Service to run malicious code.

Attack example:

sc create SysUpdate binPath = "C:\ update.exe" start = auto

Case Study: Some Malware Fake Windows Service Update

Advantage: Automatic SYSTEM permissions

Downside: Discard Event Log (7045) Detectable

6.Bootkits / MBR Modification

Method: Embed code in Boot Sector, run before OS load.

Case Study: TrickBot, NotPetya Use Bootkit to Skip Detection

Advantage: Difficult to remove. Restart, it still runs.

Disadvantages: Secure Boot must be closed and often makes the system unstable.

7.User Account Creation

Method: Create a new user account and give the administrator permission.

Attack example:

net user backupadmin P@ssw0rd123 / add

Net localgroup administrators backupadmin / add

Case Study: Many Ransomware Group uses this method to provide long-term Remote Access.

Advantage: Easy to get back in.

Downside: Leave a trace on Event ID 4720

Practical Approach

Detection and Recommended Tools

Autoruns (Sysinternals): Check Out Run Keys, Startup Programs

Sysmon: Follow Event (Registry, DLL Loads, Process Creation)

Windows Event Logs: Check Scheduled Tasks, Services, Account Creation

EDR / SIEM: Set Alert Rule for Unusual Events

Best Practices

Enable Windows Defender + Tamper Protection

Admin / Local System Restricted

Do Incident Response Drills regularly.

Use Baseline Comparison to monitor changes in the Registry and Services.

Update the system and Patch regularly.

Future Trends

Persistence moves from the basic file → memory-based (Living-off-the-Land), such as using PowerShell, WMI, or LOLBins (Windows built-in tools).

Signature-based detection is not enough. AI / Behavior Analytics is required.

Supplementing standards such as Zero Trust Security and Secure Boot + Virtualization-Based Security (VBS) will reduce the likelihood of Persistence.

The APT group emphasizes a more smooth hiding Persistence, such as embedding code in Firmware or Driver.

Conclusion (Conclusion)

Persistence is not just a malware strategy, but a "survival tool" of hackers. When Persistence is found, it is necessary to perform forensic analysis and restore the system seriously.

Understanding Persistence Techniques will make both the Red Team (tester penetrator) and the Blue Team (protector) work effectively.

Persistence Detection is a cat-chasing game that always relies on updating knowledge, tools, and proactive work.