<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: detecting-persistence-mechanisms
description: >-
  Detect and enumerate attacker persistence mechanisms including registry
  autoruns, scheduled tasks, WMI subscriptions, startup folders, services,
  and boot-level persistence. Covers baseline comparison, anomaly detection,
  and automated hunting workflows.
domain: cybersecurity
subdomain: endpoint-security
tags:
  - persistence
  - autoruns
  - scheduled-tasks
  - wmi
  - registry
  - services
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack:
    - T1547.001
    - T1053.005
    - T1546.003
    - T1543.003
    - T1547.004
---

# Detecting Persistence Mechanisms

## Overview

Persistence allows attackers to maintain access across reboots and credential
changes. Detection requires comprehensive enumeration of all autostart locations,
comparison against known-good baselines, and monitoring for real-time changes.
Sysinternals Autoruns and Sysmon provide primary visibility.

## Prerequisites

| Requirement | Purpose |
|---|---|
| Sysinternals Autoruns | Comprehensive autostart enumeration tool |
| Sysmon | Registry, WMI, and service monitoring (EID 12-14, 19-21, 6) |
| osquery | Cross-platform persistence mechanism queries |
| Scheduled task audit policy | EID 4698/4702 for task creation/modification |

## Workflow

1. **Create baseline** — Run Autoruns on clean system, export as CSV/XML
2. **Deploy monitoring** — Configure Sysmon for registry, WMI, and service events
3. **Enable audit policy** — Scheduled task creation/modification logging
4. **Schedule periodic scans** — Compare current autoruns against baseline
5. **Hunt for anomalies** — Unsigned binaries, unusual paths, encoded commands
6. **Write detection rules** — Sigma rules for known persistence patterns
7. **Investigate findings** — Validate suspicious entries, check VirusTotal hashes
8. **Remediate** — Remove malicious persistence, update baseline

## Key Commands

```powershell
# Autoruns — Full enumeration to CSV
autorunsc64 -accepteula -a * -c -h -s -v -vt > autoruns_current.csv

# Autoruns — Compare against baseline
Compare-Object (Import-Csv baseline.csv) (Import-Csv current.csv) -Property "Image Path"

# Sysmon — Monitor registry persistence
Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-Sysmon/Operational';Id=13} |
  Where-Object { $_.Message -match 'CurrentVersion\\Run' }

# Scheduled tasks enumeration
schtasks /query /fo CSV /v > scheduled_tasks.csv
Get-ScheduledTask | Where-Object { $_.State -eq 'Ready' } | Select-Object TaskName,TaskPath

# WMI subscriptions
Get-WMIObject -Namespace root\Subscription -Class __EventConsumer
Get-WMIObject -Namespace root\Subscription -Class __EventFilter
Get-WMIObject -Namespace root\Subscription -Class __FilterToConsumerBinding

# Services — Unsigned or unusual path
Get-WmiObject Win32_Service | Where-Object {
  $_.PathName -notmatch 'System32|SysWOW64|Program Files'
} | Select-Object Name,PathName,State

# Linux persistence checks
crontab -l; ls -la /etc/cron.d/; cat /etc/rc.local
systemctl list-unit-files --state=enabled
grep -r "AuthorizedKeysFile" /etc/ssh/
```

## Verification

| Check | Method |
|---|---|
| Baseline created | Autoruns CSV exists with hash values |
| Sysmon monitoring | Registry modification events (EID 13) captured |
| Scheduled task audit | EID 4698 events present for new task creation |
| WMI subscriptions enumerated | All event consumers/filters/bindings listed |
| Anomalies investigated | New entries compared against baseline and validated |

## References

- [Sysinternals Autoruns](https://learn.microsoft.com/en-us/sysinternals/downloads/autoruns)
- [MITRE ATT&CK — Persistence](https://attack.mitre.org/tactics/TA0003/)
- [Sysmon Configuration](https://github.com/SwiftOnSecurity/sysmon-config)

---
v1.0 | Validated: 2026-03-18
