Persistence · Learn

Persistence, in plain terms.

Getting in is only half an intrusion. Persistence is how an attacker stays in, surviving reboots, patches, and even password resets. This section explains the Windows, Linux, and cross-platform backdoors attackers leave, in plain language with the real technical names.

TL;DR

Persistence is how an attacker keeps access after the first compromise, so a reboot or a password reset does not lock them out. This section breaks the Windows mechanisms (registry run keys, scheduled tasks, services, WMI subscriptions), the Linux ones (SSH keys, cron, systemd, shell profiles), and cross-platform backdoors (web shells, rootkits, rogue accounts) into plain-language explainers, each ending with how a penetration test surfaces the foothold in your environment.

By John Dill, Red Team Lead, SecureLayer7Updated

Topics

  • What is Persistence?: how attackers keep access to a compromised system across reboots and password resets.
  • What is a Backdoor?: a hidden way back into a system that bypasses normal authentication.

Key terms explained

How to read this section

The pages follow where an attacker hides to keep access.

  • Foundations first: persistence and the backdoor.
  • Windows persistence: registry run keys, scheduled tasks, services, the Startup folder, WMI event subscriptions, and accessibility backdoors.
  • Linux persistence: SSH authorized_keys, cron jobs, systemd services, and shell profiles.
  • Cross-platform: web shells, rootkits, and rogue accounts.
  • Related: the Active Directory persistence techniques (Golden tickets, krbtgt) that survive even a domain-wide reset.

Each explainer ends with how a penetration test confirms the foothold in your environment.

References

  1. [1]MITRE ATT&CK: Persistence (TA0003)(MITRE)
  2. [2]MITRE ATT&CK: Boot or Logon Autostart Execution (T1547)(MITRE)
  3. [3]NIST SP 800-83 Malware Incident Prevention and Handling(NIST)
Related terms

Scope an engagement

Find the backdoors an attacker would leave behind.

Our red-team and internal penetration tests show where an intruder could hide to survive a reboot or a password reset, registry keys, scheduled tasks, services, web shells, and rogue accounts, then hand your team the evidence and the fix. Free re-test included.

See all services30-min scoping call, fixed-price proposal in 48 hours.