When an attacker successfully breaches a system, their primary objective is to ensure they can stay in. This phase of an attack is known as establishing persistence. Without it, a simple system reboot or a timed-out session could lock the intruder out, forcing them to repeat the initial exploit. To protect your environment, you must learn to hunt for these hidden footholds.

Hunting on Windows Systems

On Windows, attackers typically hide their persistence in three main areas: run keys, scheduled tasks, and services.

• Run Keys: These are registry keys that instruct the operating system to execute specific programs automatically upon startup.
  • Example: An attacker might add a value to HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run that launches a malicious script disguised as a system update.
• Scheduled Tasks: These allow scripts or programs to run at specific times or in response to specific triggers.
  • Example: A task configured to run every day at 3:00 AM that beacons out to a Command and Control (C2) server.
• Services: Malicious services can be created to run in the background with high-level system privileges.

To streamline this process, the source recommends using Autoruns, a utility that displays all of these persistence locations in a single view.

Hunting on Linux Systems

Linux environments offer different, yet equally effective, hiding spots for persistent threats. Key areas to audit include:

• Cron Jobs: These are time-based job schedulers. Attackers often place entries here to ensure their malware restarts periodically.
• Systemd Units: As the init system for many Linux distributions, systemd manages services. A custom service unit file can be used to maintain a persistent backdoor.
• Shell Profiles: Files like .bashrc or .profile execute every time a user logs in. By injecting a line of code here, an attacker can regain access the moment an administrator opens a terminal.

The Power of the “Known Good” Baseline

The most effective way to identify a threat is to compare your current system state against a known good baseline. By knowing what a “clean” system looks like, the malicious entries will stand out as anomalies.

• Example: If your baseline shows only five standard services running, and your current scan shows six, that sixth service—regardless of how legitimate its name might look—is your primary suspect.

The Stakes of the Hunt

Persistence hunting is a “zero-sum” game. If you successfully identify and kick out their persistence, the attacker loses control of the box. however, the margin for error is non-existent: if you miss even one hidden task or registry key, the attacker will be back tomorrow.