Persistence.

What is persistence in cyber security?

Persistence is how an attacker keeps their foothold. Getting in once is not always enough, because a restart or a credential change can cut an attacker off. So they try to set up a way to keep their access.

MITRE ATT&CK lists Persistence as tactic TA0003. It describes the tactic as the adversary trying to maintain their foothold. A tactic is the goal. A technique is one specific way to reach that goal. MITRE says persistence techniques keep access across system restarts, credential changes and other interruptions.

How does persistence work?

The attacker leaves something behind that gives them a way back. MITRE lists several techniques under this tactic:

• Create Account, T1136.
• Account Manipulation, T1098.
• Boot or Logon Autostart Execution, T1547.
• Create or Modify System Process, T1543.
• Scheduled Task/Job, T1053.

These are persistence mechanisms: concrete things an attacker can add or change so that access survives. Scheduled Task/Job is also listed under Execution and Privilege Escalation, so one technique can serve more than one goal.

What does persistence look like in a simple example?

This is a simple illustration, not a real case. MITRE says adversaries may create accounts to maintain access to victim systems. This lets them keep access without needing a remote access tool left running. MITRE also says adversaries may abuse task scheduling to run malicious code once or again and again. Either approach gives an attacker a route back in.

How can you detect and reduce persistence?

MITRE gives advice on its technique pages. For Create Account, it says to limit the number of accounts that can create other accounts, and to use multi-factor authentication for user and privileged accounts. Multi-factor authentication means a login needs more than a password.

For Scheduled Task/Job, MITRE suggests restricting user privileges so that only authorized administrators can create remote scheduled tasks.

On detection, MITRE says to look for suspicious scheduled task creation or change. It names tools such as schtasks.exe on Windows, crontab changes on Linux and LaunchAgents on macOS. For account creation, it points to Windows event ID 4720, the useradd command on Linux and cloud identity logs.

How does persistence relate to other terms?

Persistence is one tactic among several in ATT&CK. Related terms include ransomware, which is malware that locks files and demands payment, and multi-factor authentication, which MITRE lists as a mitigation for the Create Account technique. An indicator of compromise is a trace of an attack, such as a strange account, and that kind of trace is what defenders look for when they hunt for persistence.

Is persistence the same as initial access?

No. Initial access is about first getting in. Persistence is the tactic where the adversary tries to maintain their foothold. They are different goals, and one attack can involve both.

Does changing a password remove an attacker?

Not by itself. If the attacker added another account or a scheduled task, a password reset alone will not remove their access. This follows from how persistence is defined: it is meant to survive credential changes.

What is a persistence technique?

A persistence technique is one specific method listed under the Persistence tactic, such as Create Account or Scheduled Task/Job. Each one has its own page on attack.mitre.org with a description, mitigations and detection notes.