Persistence

Windows Account and Backdoor Creation

Creates persistent backdoor access via Windows local accounts, net user commands, and administrator group manipulation to maintain long-term system compromise.

Apr 4, 2026 • 4 min read

Windows Golden and Silver Ticket Persistence

Covers Kerberos-based persistence via forged Golden (krbtgt) and Silver (service) tickets, enabling long-term domain access without valid credentials.

Apr 4, 2026 • 4 min read

Windows Registry Persistence

Covers Windows Registry-based persistence techniques, including Run keys, Winlogon hijacking, and COM hijacking to maintain attacker footholds.

Apr 4, 2026 • 5 min read

Windows Scheduled Task Persistence

Covers abusing Windows Task Scheduler (schtasks/COM) to establish persistent execution, including trigger types, privilege levels, and XML task configurations.

Apr 4, 2026 • 3 min read

Windows Service Persistence

Establish persistent footholds by creating or hijacking Windows services, ensuring malicious payloads survive reboots and maintain long-term system access.

Apr 4, 2026 • 3 min read

Windows Web Shell Persistence

Covers detecting and mitigating web shell implants on Windows servers used by attackers to maintain persistent backdoor access via HTTP.

Apr 4, 2026 • 3 min read