5.1 Given a scenario, perform tasks to establish and maintain persistence.

Mechanisms

Scheduled tasks/cron jobs

Jobs that re-launch access on a schedule. Hunt: new or unusual tasks and crontab entries.

Service creation

Installing a service that starts automatically.

Reverse shell

The target connects out to the tester's listener, bypassing inbound firewall rules.

Bind shell

The target listens on a port for the tester to connect in.

Add new accounts

Creating accounts for continued access. Hunt: account creation events.

Obtain valid account credentials

Using real credentials, which blends in with normal activity.

Registry keys

Windows Run keys and similar locations that launch programs at logon.

Command and control (C2) frameworks

Platforms that manage implants, tasks and communication with compromised hosts.

Backdoor

Hidden access method.

Web shell

A server-side script giving command access through HTTP.

Trojan

A legitimate-looking program with hidden malicious function.

Rootkit

Deep, stealthy persistence that hides itself; rarely used in tests because of risk.

Browser extensions

Malicious extensions that persist in the browser and access pages and cookies.

Tampering security controls

Disabling or weakening defences to keep access; tests whether tampering is detected.