LAB-14Easy

Persistence Detection

Identify persistence mechanisms from strings and imports.

15 min5 prerequisites6 tools

Investigate

Hints

Hint 1

The Run key is the classic registry autostart location.

Hint 2

Masquerading as svchost.exe is a common evasion.

Hint 3

RegSetValueEx writes a Run value; CreateServiceW installs a service.

Submit Findings

Prerequisites

  • m2-persistence
  • sa1-strings-metadata
  • sa2-imports-exports
  • Windows persistence mechanisms (Run, Services, Scheduled Tasks, WMI, etc.)
  • MITRE ATT&CK: T1547

Methodology

Investigation Methodology

1. Persistence Taxonomy (MITRE ATT&CK T1547)

Sub-technique Registry/Location Key APIs
Boot/Logon Autostart
Registry Run Keys HKCU/HKLM...\Run, RunOnce RegCreateKeyEx, RegSetValueEx
Winlogon HKLM...\Winlogon (Userinit, Shell) RegSetValueEx
Scheduled Tasks Task Scheduler ITaskScheduler, ITaskFolder
Services HKLM\SYSTEM\CurrentControlSet\Services CreateService, ChangeServiceConfig
Startup Folder %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup CopyFile, SHGetFolderPath
WMI Event Subscription WMI Repository IWbemServices, CreateInstance
Browser Helper Objects HKLM...\Explorer\Browser Helper Objects RegSetValueEx
AppInit_DLLs HKLM...\Windows (AppInit_DLLs) RegSetValueEx

2. Static Indicators

Strings:

  • Run, RunOnce, RunServices, RunServicesOnce
  • Services, CurrentControlSet\Services
  • Startup, Start Menu, Programs
  • Task, Scheduler, Schedule
  • WMI, EventFilter, Consumer

Imports:

  • Registry: RegCreateKeyEx, RegSetValueEx, RegOpenKeyEx
  • Services: CreateService, OpenService, ChangeServiceConfig, StartService
  • Tasks: ITaskScheduler, ITaskFolder, RegisterTask
  • Files: CopyFile, MoveFile, SHGetFolderPath, SHGetKnownFolderPath
  • WMI: IWbemServices, IWbemLocator, ConnectServer

3. Masquerading Patterns

Technique Example
System binary name svchost.exe, lsass.exe, csrss.exe, winlogon.exe
System directory %SYSTEM32%\, %WINDIR%\
Legitimate publisher Microsoft Corporation (fake cert)
Similar name svch0st.exe, lsasss.exe, update.exe

4. Correlation

  • String Run + Import RegSetValueEx → Run Key
  • String Services + Import CreateService → Service
  • String Startup + Import CopyFile + Path %APPDATA% → Startup Folder
  • Import CreateService + String svchost.exe → Service masquerading as system

5. Detection & Removal

  • Run Keys: reg delete / autoruns
  • Services: sc delete / services.msc
  • Tasks: schtasks /delete / Task Scheduler
  • WMI: wmic / PowerShell Remove-WmiObject
  • Files: Delete + hash for blocklist

Common Pitfalls

  • Missing HKCU vs HKLM — both used, HKCU = user-level, HKLM = system
  • Overlooking `RunOnce` — runs once, then deletes itself (stealthier)
  • Confusing `CreateService` (installs) with `StartService` (runs)
  • Not checking `ImagePath` in service — often points to dropped file
  • Missing `AppInit_DLLs` — loads DLL into every process with User32

Tools

  • Autoruns (Sysinternals) — comprehensive persistence view
  • RegEdit / PowerShell (registry)
  • Procmon (dynamic — filter RegSetValue, CreateFile)
  • Ghidra (strings + imports)
  • KAPE / Velociraptor (collection)
  • YARA rules for persistence patterns

References

  • Lesson M2: Persistence
  • Lesson SA1: Strings & Metadata
  • Lesson SA2: Imports & Exports
  • MITRE ATT&CK: T1547 (Boot/Logon Autostart)
  • Microsoft: Run and RunOnce Registry Keys
  • Autoruns Documentation

Extensions & Challenges

  • Write a YARA rule detecting Run key + masquerade string (e.g., svchost.exe)
  • Analyze a sample with Scheduled Task persistence — find the XML
  • Research: WMI Event Subscription persistence — how to detect statically?
  • Build a persistence enumeration script for incident response
  • Test: Create a service with `sc create`, observe registry artifacts