Persistence Concepts

# RoE: authorised testing only on systems you own / have written permission to test.
# Test in a lab VM. Never on production.

# ===== Why study this =====
# After initial compromise, attackers want to maintain access across reboots,
# patches, and credential rotations. Defenders need to know the vectors to
# detect and prevent them.

# ===== Common vectors (with defenses) =====

# 1. Scheduled tasks (Windows) / cron jobs (Linux)
# Attackers add tasks that run at boot, login, or interval.
# Detect:
schtasks /query /fo LIST /v | findstr /i "author user"
ls -la /etc/cron.* /var/spool/cron/

# Defense:
# - Audit scheduled tasks weekly
# - Detection rule: new scheduled task created by non-admin
# - File integrity monitoring on /etc/cron.*

# 2. Startup folders + registry Run keys
# Windows: HKCU/HKLM\Software\Microsoft\Windows\CurrentVersion\Run
# Linux: ~/.bashrc, /etc/profile, /etc/rc.local
# Detect:
reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Run

# Defense:
# - AppLocker / Windows Defender Application Control
# - Sysmon Event ID 12-14 (registry changes)
# - File integrity monitoring on user startup files

# 3. WMI event subscriptions (Windows)
# WMI permanent subscriptions trigger on system events; persist across reboots.
# Detect:
Get-WMIObject -Namespace root\subscription -Class __EventFilter
Get-WMIObject -Namespace root\subscription -Class __FilterToConsumerBinding

# Defense:
# - Monitor WMI activity (Sysmon Event IDs 19-21)
# - Restrict WMI access via firewall + DCOM permissions

# 4. SSH authorized_keys (Linux)
# Attackers add their public key to ~/.ssh/authorized_keys.
# Detect:
find / -name authorized_keys 2>/dev/null
for k in /home/*/.ssh/authorized_keys; do echo "=== $k ==="; cat $k; done

# Defense:
# - Disable password auth; require key-based + tracked keys
# - Use CA-signed SSH keys with short TTL
# - File integrity monitoring on authorized_keys
# - Alert on changes; review weekly

# 5. systemd services (Linux)
# Attackers create a systemd unit that runs on boot.
# Detect:
systemctl list-unit-files --type=service | grep enabled
find /etc/systemd/system -name '*.service' -newer /tmp/reference

# Defense:
# - File integrity monitoring on /etc/systemd/system
# - Detection rule: new service unit with suspicious ExecStart

# 6. Browser extensions / plugins
# Attackers install browser extensions for persistence + data exfil.
# Detect: enumerate installed extensions per browser.
# Defense:
# - Enterprise browser policies restricting installation
# - Allowlist approved extensions

# 7. Boot / firmware level (advanced)
# UEFI / bootkit persistence survives OS reinstall.
# Defense:
# - Secure Boot enabled
# - TPM + measured boot
# - UEFI firmware password
# - Verify boot integrity via Microsoft Defender ATP / Linux IMA

# ===== Detection patterns (SIEM rules) =====
# - New scheduled task created by non-admin user
# - Registry Run key modification
# - New file in StartUp folder
# - WMI permanent subscription created
# - authorized_keys file modified
# - New systemd unit enabled at boot
# - Cron job added that points to a writable directory
# - Service binary changed but service file unmodified (DLL hijack)

# ===== Defensive baseline =====
# - Endpoint EDR (Defender ATP, CrowdStrike, SentinelOne)
# - Centralised logging (Splunk, Sentinel, Elastic)
# - Sysmon on Windows + auditd on Linux
# - File integrity monitoring (Wazuh, Tripwire, AIDE)
# - AppLocker / WDAC on Windows
# - Secure Boot + TPM
# - Privileged access management (CyberArk, Delinea)

# ===== Tools (defensive lab use) =====
# - Sysinternals Autoruns (Windows): enumerate startup locations
# - PSReadLine + transcript logging
# - osquery: scheduled queries on persistence locations
# - Wazuh: open-source SIEM + FIM
# - Falco: runtime security for Linux + containers

# ===== Patterns to internalise =====
# - RoE FIRST; lab only
# - Every persistence vector pairs with a detection + hardening note
# - Inventory ALL startup mechanisms quarterly
# - Alert on changes; do not just log
# - Patch + minimise + log: the three pillars

# ===== Pitfalls =====
# - Testing on production
# - Sharing exploits publicly without coordinating
# - Skipping the hardening write-up
# - Trusting Defender / EDR without monitoring its own health

# Persistence techniques exist so defenders can detect them:
#   - cron / systemd timers / Scheduled Tasks
#   - SSH authorized_keys, Run keys, services
# In a pentest, document any persistence you set up and REMOVE it before disengagement.