<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
---
name: performing-c2-persistence-mechanisms
description: >-
  Implement and detect C2 persistence mechanisms including registry run keys, scheduled tasks, WMI subscriptions, COM hijacking, and DLL search order hijacking for maintaining access.
domain: cybersecurity
subdomain: c2-frameworks
tags:
  - persistence
  - registry
  - scheduled-task
  - wmi-subscription
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1547.001"]
  frameworks: ["MITRE ATT&CK"]
  tools: ["powershell", "schtasks", "wmi"]
---

# Performing C2 Persistence Mechanisms

## Overview

Implement and detect C2 persistence mechanisms including registry run keys, scheduled tasks, WMI subscriptions, COM hijacking, and DLL search order hijacking for maintaining access.

## Prerequisites

| Tool / Requirement | Details |
|---|---|
| `powershell` | Security tooling |
| `schtasks` | Security tooling |
| `wmi` | Security tooling |
| C2 framework, administrative access on target, persistence testing environment | Environment requirement |

## Quick Reference

```bash
# Quick start commands
node scripts/agent.js --help
node scripts/agent.js deploy --method registry --key HKCU\Software\Microsoft\Windows\CurrentVersion\Run
```

## Workflow

### Step 1: Deploy Registry Persistence

```bash
node scripts/agent.js deploy --method registry --key HKCU\Software\Microsoft\Windows\CurrentVersion\Run
```

### Step 2: Configure Scheduled Task

```bash
node scripts/agent.js deploy --method schtask --trigger logon
```

### Step 3: Test WMI Subscription

```bash
node scripts/agent.js deploy --method wmi --event-filter ProcessStart
```

## Detection

```yaml
title: C2 Persistence Mechanisms Detection
id: fec0ded1-a446-4e2a-9da0-e21af3b050f4
status: experimental
description: Detects suspicious activity related to performing c2 persistence mechanisms techniques in c2 frameworks context
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationPort: 443
    Initiated: "true"
  condition: selection
level: high
tags:
  - attack.t1547.001
  - attack.command_and_control
falsepositives:
  - Authorized penetration testing tools during scheduled assessments
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| C2 Persistence Mechanisms Detection | windows/network_connection | Sigma rule (high) |
| ATT&CK Coverage | MITRE ATT&CK | T1547.001 |

## Verification

- **Verify persistence**: `node scripts/agent.js verify --method registry`
- **Confirm callback**: `node scripts/agent.js test --method schtask`

## References

- MITRE ATT&CK: T1547.001
- Frameworks: MITRE ATT&CK
- Tools: powershell, schtasks, wmi
