Persistence

Persistence ensures continued access to the environment across reboots, password changes, and other routine events. Whether persistence is established depends on the engagement scope and rules of engagement. Persistence should be a consideration for every host accessed, including intermediate hosts and accesses that are part of a chain.

Execution examples

Common persistence mechanisms include scheduled tasks, registry run keys, SSH authorized keys, and golden tickets. Each has a different longevity and detection profile:

# Windows scheduled task
schtasks /create /sc onstart /tn "TaskName" /tr "C:\path\to\payload.exe" /ru SYSTEM

# Linux SSH key
echo "ssh-rsa ATTACKER_KEY" >> ~/.ssh/authorized_keys

# Golden ticket
kerberos::golden /User:FakeAdmin /domain:domain.local /sid:SID /krbtgt:HASH /id:500 /ptt

Persistence should always be documented and removed at the conclusion of the engagement unless the client specifically requests otherwise.