Persistence methods

Many malware used the persistence method to maintain the foothold on the system that was infected even when the system is restarted.

They are many technics often used by malware to maintain the persistency such as: registry keys, the startup folder, account manipulation, device registration and others Persistence, Tactic TA0003 - Enterprise | MITRE ATT&CK®.

Registry Keys used for persistency.

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce

Startup folder used for persistency.

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders

Tools used to detect and remove malware using persistence method.

Autoruns Autoruns for Windows - Sysinternals | Microsoft Learn
Sysmon Sysmon - Sysinternals | Microsoft Learn
Endpoint Detection and Response such as:
Crowdstrike CrowdStrike: Stop breaches. Drive business
Sophos Intercept X Endpoint https://www.sophos.com/
SentinelOne SentinelOne | Autonomous AI Endpoint Security Platform | s1.ai
Microsoft Defender Microsoft Defender for Individuals | Microsoft 365
PowerShell logging, PowerShell GetWmi-Object, OSQuery, Antimalware Scan Interface How to detect persistence mechanisms with seven different tools (redcanary.com)

In conclusion, the persistence method is one of the favorites methods used by the threats actors to compromise the system. They are many malware that used the technics described above to maintain the foothold to the system. Following the best practices such as using tools to detect and remove the malware is the key to stay protected.