Persistence

RDP persistence techniques keep remote desktop access available after initial exploitation. The sticky keys backdoor replaces sethc.exe (or utilman.exe) with cmd.exe, giving you a SYSTEM shell from the lock screen by pressing Shift five times. This survives reboots and does not require credentials to trigger.

RDP Wrapper (rdpwrap) enables concurrent RDP sessions on Windows editions that normally restrict it, and hides your sessions from legitimate users. Registry-based persistence through EnableRestrictedAdmin, fDenyTSConnections, and autologon keys ensures RDP stays accessible with your preferred configuration.

Shadow sessions (RDP shadowing) let you monitor or control an active user's session without them noticing, depending on group policy settings. Combine this with a created or compromised account in the Remote Desktop Users group for persistent access that blends with normal administration traffic.