[Jumpy22]

This post will detail some popular and unpopular persistence techniques used by malware. If you have any questions or anything to add please comment.

😶 - Stealth (If setup properly will not interrupt the user)
👁 - Mild (Easy for user to find)
🗣️ - Loud (Likely cause problems for user)

Startup Folder [👁]
One of the most common forms of persistence. It's very simple, anything put into

Code

%appdata%\Microsoft\Windows\Start Menu\Programs\Startup

will be run. This includes any applications, lnk files, and scripts. These are launched at startup by explorer.exe and run within the context of the current user. This directory is generally writeable by a non-privileged user. Affects most windows versions and does not effect normal usage. Only runs after user logon.

Run & RunOnce Registry Keys [👁]
These are grouped together as they work extremely similar. It is done by adding a registry value to either of these registry keys.

Code

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce

The values can be either locations of files to execute or can be used for fileless execution (launching powershell or cmd to run commands). The difference between Run and RunOnce is that Run is persistence through multiple startups while RunOnce is cleared after startup is completed. The values are run be the explorer.exe process using a ShellExecute call. Only runs after user logon.

The two above will show up in the Startup section in Task Manager.

Task Scheduler [😶]
Task Scheduler is a service built into windows for setting up tasks to run when certain criteria are met. This is perfect for malware as it can execute files, scripts, and even fileless techniques whenever certain actions happen (login, certain time of day, etc). It is stealthier to make the task run some time after startup while more events are being generated by user interaction with the machine. Tasks can be scheduled directly through schtasks or appended to the following registry keys (though I have not tried this).

Code

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\Schedule\TaskCache
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\Schedule\Tasks

Screensaver [👁]
Windows screensavers are run as though they are executable files. This can be taken advantage of by changing the following registry key with the location of a exe file renamed to .scr.

Code

HKCU\Control Panel\Desktop

The file will only be run when the screensaver would be spawned (user inactivity).

I will write more in the coming hours

[RedirkNames]

These are all heavily monitored persistence techniques & will immediately be flagged by any security solution.

[Wells]

These are all heavily monitored persistence techniques & will immediately be flagged by any security solution.

Not necessarily true. While most persistence methods are monitored and intercepted, they aren’t automatically flagged. Flagging and blocking are different measures; only the former is really negative, in my opinion at least.

[Jumpy22]

These are all heavily monitored persistence techniques & will immediately be flagged by any security solution.

If security solutions flagged every persistence technique then no legitimate unsigned app would be able to add itself to startup. This is false.