Hack Forums
Windows Persistence Mechanisms - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Blackhat • Red Team • Offensive Security (https://hackforums.net/forumdisplay.php?fid=447)
+---- Forum: Malware and Viruses (https://hackforums.net/forumdisplay.php?fid=287)
+---- Thread: Windows Persistence Mechanisms (/showthread.php?tid=6317332)

Windows Persistence Mechanisms - Jumpy22 - Jan 6, 2026

This post will detail some popular and unpopular persistence techniques used by malware. If you have any questions or anything to add please comment.

😶 - Stealth (If setup properly will not interrupt the user)
👁 - Mild (Easy for user to find)
🗣️ - Loud (Likely cause problems for user)

Startup Folder [👁]
One of the most common forms of persistence. It's very simple, anything put into
Code
%appdata%\Microsoft\Windows\Start Menu\Programs\Startup
will be run. This includes any applications, lnk files, and scripts. These are launched at startup by explorer.exe and run within the context of the current user. This directory is generally writeable by a non-privileged user. Affects most windows versions and does not effect normal usage. Only runs after user logon.

Run & RunOnce Registry Keys [👁]
These are grouped together as they work extremely similar. It is done by adding a registry value to either of these registry keys.
Code
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce
The values can be either locations of files to execute or can be used for fileless execution (launching powershell or cmd to run commands). The difference between Run and RunOnce is that Run is persistence through multiple startups while RunOnce is cleared after startup is completed. The values are run be the explorer.exe process using a ShellExecute call. Only runs after user logon.

The two above will show up in the Startup section in Task Manager.

Task Scheduler [😶]
Task Scheduler is a service built into windows for setting up tasks to run when certain criteria are met. This is perfect for malware as it can execute files, scripts, and even fileless techniques whenever certain actions happen (login, certain time of day, etc). It is stealthier to make the task run some time after startup while more events are being generated by user interaction with the machine. Tasks can be scheduled directly through schtasks or appended to the following registry keys (though I have not tried this).
Code
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\Schedule\TaskCache
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\Schedule\Tasks

Screensaver [👁]
Windows screensavers are run as though they are executable files. This can be taken advantage of by changing the following registry key with the location of a exe file renamed to .scr.
Code
HKCU\Control Panel\Desktop
The file will only be run when the screensaver would be spawned (user inactivity).

I will write more in the coming hours

RE: Windows Persistence Mechanisms - RedirkNames - Jan 13, 2026

These are all heavily monitored persistence techniques & will immediately be flagged by any security solution.

RE: Windows Persistence Mechanisms - Wells - Jan 13, 2026

(Jan 13, 2026 03:38 PM)RedirkNames Wrote:  These are all heavily monitored persistence techniques & will immediately be flagged by any security solution.

Not necessarily true. While most persistence methods are monitored and intercepted, they aren’t automatically flagged. Flagging and blocking are different measures; only the former is really negative, in my opinion at least.

RE: Windows Persistence Mechanisms - Jumpy22 - Jan 24, 2026

(Jan 13, 2026 03:38 PM)RedirkNames Wrote:  These are all heavily monitored persistence techniques & will immediately be flagged by any security solution.

If security solutions flagged every persistence technique then no legitimate unsigned app would be able to add itself to startup. This is false.