Persistence

Windows Account and Backdoor Creation

Creates persistent backdoor access via Windows local accounts, net user commands, and administrator group manipulation to maintain long-term system compromise.

Windows Golden and Silver Ticket Persistence

Covers Kerberos-based persistence via forged Golden (krbtgt) and Silver (service) tickets, enabling long-term domain access without valid credentials.

Windows Registry Persistence

Covers Windows Registry-based persistence techniques, including Run keys, Winlogon hijacking, and COM hijacking to maintain attacker footholds.

Windows Scheduled Task Persistence

Covers abusing Windows Task Scheduler (schtasks/COM) to establish persistent execution, including trigger types, privilege levels, and XML task configurations.

Windows Service Persistence

Establish persistent footholds by creating or hijacking Windows services, ensuring malicious payloads survive reboots and maintain long-term system access.

Windows Web Shell Persistence

Covers detecting and mitigating web shell implants on Windows servers used by attackers to maintain persistent backdoor access via HTTP.