Persistence Mechanisms

Malware Wants to Survive Reboot

Persistence is how malware ensures it runs again after a reboot, login, or process death. Analysts memorize the locations because they’re the first place to check — and clean up.

The Big Three

Mechanism	Location / API	Notes
Run keys	HKLM\...\Run, HKCU\...\Run	most common; via RegSetValueEx
Services	CreateService / sc create	runs at boot with SYSTEM privileges
Scheduled tasks	schtasks / COM	time-based or event-based triggers

More Persistence Locations

• Startup folders — Start Menu\Programs\Startup.
• Winlogon — Userinit, Shell values in the registry.
• AppInit_DLLs — DLL loaded into every GUI process.
• IFEO (Image File Execution Options) — “Debugger” value hijacks process launch.
• COM hijacking — replace a COM object’s in-proc server.
• WMI subscriptions — event-based persistence, hard to spot.

The Registry Run Key, In Detail

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
  "Updater" = "C:\Users\x\AppData\Roaming\updater.exe"

The binary drops itself, writes this value, and every login runs it. In a lab, RegSetValueExW + a Run-key string is the smoking gun.

Tracing Persistence

Work backwards:

1. String — find the Run-key path or service name in strings.
2. API — find RegSetValueEx / CreateService and its arguments.
3. Artifact — confirm the value/key exists on an infected host.

Takeaway

Persistence is the malware’s way of saying “I’ll be back.” Learn the locations, and it can’t hide.

Lab 14: Persistence Detection → Persistence Detection