Getting in is the easy part. Surviving a reboot is what turns an intrusion into a breach.
What Are Malware Persistence Mechanisms?
Persistence mechanisms are the techniques malware uses to keep running through restarts, logoffs, and clean-up attempts. MITRE ATT&CK treats persistence as its own tactic, TA0003. (MITRE ATT&CK)
Almost all of them abuse features the operating system ships with. A registry key or a scheduled task is not malicious in itself, so the technique hides inside normal behaviour.
How Does Persistence Work?
Three things must line up: code the attacker controls, a legitimate mechanism that re-executes it, and a location nobody routinely inspects.
Persistence is usually established early, before the payload does anything visible.
Top 6 Malware Persistence Mechanisms
1. Registry Run Keys and the Startup Folder
The most common Windows approach. Malware writes a value under a Run key so it executes at logon (T1547.001). Commonly targeted locations: (MITRE ATT&CK)
HKCU\Software\Microsoft\Windows\CurrentVersion\RunHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunHKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce
A shortcut in the Startup folder does the same job without touching the registry.
2. Windows Services
Creating a service, or repointing an existing one at attacker-controlled code, gives persistence that runs at boot and can execute with high privileges depending on the service configuration (T1543.003). (MITRE ATT&CK)
This typically requires administrative or equivalent privileges, so it often appears after privilege escalation rather than before it.
3. Scheduled Tasks and Cron Jobs
Windows Scheduled Tasks and Linux cron give attackers timed or event-driven execution (T1053). (MITRE ATT&CK)
Triggers can be tied to boot, logon, idle time, an interval, or an event. A task that fires weekly rather than at every boot falls outside the window most responders check.
4. Boot and Logon Scripts
Logon and Group Policy scripts on Windows map cleanly to ATT&CK's Boot or Logon Initialization Scripts (T1037). On Linux, shell startup files such as .bashrc or .profile are better mapped to Unix Shell Configuration Modification (T1546.004), while systemd services are a separate persistence technique under T1543.002. (MITRE ATT&CK)
Group Policy scripts matter most here. One change in Active Directory can persist across every machine the policy applies to.
5. DLL Search Order Hijacking
When a program loads a library by name rather than a full path, Windows searches a defined order of directories. A malicious DLL placed in a directory searched first gets loaded by the legitimate application (T1574.001). (MITRE ATT&CK)
The code then runs inside a signed, trusted process. Process injection often appears alongside this, but injection alone is not persistence.
6. Bootkits and Firmware Implants
Bootkits and firmware implants are related but not identical. Bootkits target the boot chain, for example MBR/VBR or EFI boot components (T1542.003), while firmware implants modify system or device firmware itself. Both operate below or before the operating system, but firmware implants are a separate class from bootkits. (MITRE ATT&CK)
BlackLotus, analysed by ESET and later covered by Microsoft, used CVE-2022-21894 to bypass Windows Secure Boot and deploy malicious files to the EFI System Partition. (WeLiveSecurity, Microsoft)
Firmware persistence can survive an operating system reinstall. Some UEFI/boot-chain persistence can also survive a standard OS reinstall if the EFI or boot partition is not fully cleaned.
Why Does It Matter?
Persistence decides whether an incident is contained or repeated. Remove the payload, close the ticket — and if the scheduled task, autorun entry, or other persistence mechanism remains, the access can come back on its own.
Common Mistakes
- Assuming a signed process is trustworthy. DLL hijacking means the signature belongs to the loader, not the loaded code.
- Treating firmware as the priority. Bootkits are real but uncommon. Registry keys and scheduled tasks are what you will find.
How to Reduce the Risk
- Baseline autoruns, services, and scheduled tasks, and alert on changes
- Enable and monitor Secure Boot, and keep firmware in the patch cycle
- Block execution of unsigned code from user-writable directories
- Watch for signed binaries loading DLLs from unexpected paths
What Should Security Testing Cover?
Ask your testers to establish:
- Whether a new scheduled task or service raises an alert anyone acts on
- Which persistence locations a standard user can write to
- What your response process removes, and what it leaves behind
How OraSec Can Help
Persistence is only visible if something watches the places it lives. OraSec's red teaming establishes persistence as an attacker would and measures what your tooling records, while internal penetration testing maps which mechanisms an ordinary user can reach.
Conclusion
That is why detection has to be about change, not signatures. Nothing about a Run key is suspicious. A Run key that was not there yesterday is.
FAQs
What is the most common persistence mechanism? Registry Run keys and Startup-folder persistence are among the most common Windows mechanisms. User-level variants do not require admin rights, while machine-wide variants may.
Does reinstalling the operating system remove persistence? Usually, yes — but not always. Firmware implants can survive an OS reinstall, and some boot-chain or EFI-partition persistence can also survive if the reinstall does not fully clean those components.
Is process injection a persistence technique? Not on its own. It hides code inside a running process, but something else must re-launch it after a reboot.
How do we find persistence already in our environment? Compare autoruns, services, scheduled tasks, and startup items against a known-good baseline, then investigate anything with no change record.
