Windows Persistence

⚠️ Content of this page has been moved to InternalSecurityResources/redteam/persistence/windows

• Tools

• Hide Your Binary

• Disable Antivirus and Security

  • Antivirus Removal

  • Disable Windows Defender

  • Disable Windows Firewall

  • Clear System and Security Logs

• Simple User

  • Registry HKCU

  • Startup

  • Scheduled Tasks User

  • BITS Jobs

• Serviceland

  • IIS

  • Windows Service

• Elevated

  • Registry HKLM

    • Winlogon Helper DLL

    • GlobalFlag

  • Startup Elevated

  • Services Elevated

  • Scheduled Tasks Elevated

  • Binary Replacement

    • Binary Replacement on Windows XP+

    • Binary Replacement on Windows 10+

  • RDP Backdoor

    • utilman.exe

    • sethc.exe

  • Remote Desktop Services Shadowing

  • Skeleton Key

  • Virtual Machines

  • Windows Subsystem for Linux

• Domain

  • Golden Certificate

  • Golden Ticket

• References