Procedure examples

MacSpy persists via a Launch Agent.

Mini Shai-Hulud has established persistence on macOS hosts by installing a gh-token-monitor daemon through LaunchAgent that polls GitHub every 60 seconds.

Depending on the Linux distribution and when executing with root permissions, RotaJakiro may install persistence using a `.service` file under the `/lib/systemd/system/` folder.

Exaramel for Linux has a hardcoded location under systemd that it uses to achieve persistence if it is running as root.

Gomir creates a systemd service named `syslogd` for persistence.

Hildegard has started a monero service.

Fysbis has established persistence using a systemd service.

SysUpdate can copy a script to the user owned `/usr/lib/systemd/system/` directory with a symlink mapped to a `root` owned directory, `/etc/ystem/system`, in the unit configuration file's `ExecStart` directive to establish persistence and elevate privileges.

RIFLESPINE can create a systemd service file for execution.

Shai-Hulud has stopped `systemd-resolved` in order to manipulate DNS and firewalls.

Pupy can be used to establish persistence using a systemd service.

TeamPCP Cloud Stealer can create a systemd unit to execute a python script for persistence.

Mini Shai-Hulud has created .service files using Systemd on victim Linux hosts to establish persistence.

TrickBot establishes persistence by creating an autostart service that allows it to run whenever the machine boots.

Ninja can create the services `httpsvc` and `w3esvc` for persistence .

Wiarp creates a backdoor through which remote attackers can create a service.

The Exaramel for Windows dropper creates and starts a Windows service named wsmprovav with the description “Windows Check AV.”

Stuxnet uses a driver registered as a boot start service as the main load-point.

If running as administrator, TDTESS installs itself as a new service named bmwappushservice to establish persistence.

Emissary is capable of configuring itself as a service.

Ursnif has registered itself as a system service in the Registry for automatic execution at system startup.

ThreatNeedle can run in memory and register its payload as a Windows service.

ZLib creates Registry keys to allow itself to run as various services.

Bankshot can terminate a specific process by its process id.

StrongPity has created new services and modified existing services for persistence.

Nebulae can create a service to establish persistence.

AuditCred is installed as a new service on the system.

TONESHELL has created a malicious service DISMsrv to maintain persistence.

Hannotog creates a new service for persistence.

Medusa Ransomware has created a new PowerShell process using the `CreateProcessA` API.

RainyDay can use services to establish persistence.

BOOKWORM has created a service named `Microsoft Windows DeviceSync Service` at `HKLM\SYSTEM\CurrentControlSet\Services\DeviceSync\` to trigger execution when the system starts and to maintain persistence.

CosmicDuke uses Windows services typically named "javamtsup" for persistence.

GreyEnergy chooses a service, drops a DLL file, and writes it to that serviceDLL Registry key.

Emotet has been observed creating new services to maintain persistence.

TEARDROP ran as a Windows service from the c:\windows\syswow64 folder.

DUSTPAN can persist as a Windows Service in operations.

PingPull has the ability to install itself as a service.

SUGARUSH has created a service named `Service1` for persistence.

WastedLocker created and established a service that runs until the encryption process is complete.

InvisiMole can register a Windows service named CsPower as part of its execution chain, and a Windows service named clr_optimization_v2.0.51527_X86 to achieve persistence.

Naid creates a new service to establish.

Volgmer installs a copy of itself in a randomly selected service, then overwrites the ServiceDLL entry in the service's Registry entry. Some Volgmer variants also install .dll files as services with names generated by a list of hard-coded strings.

ZeroT can add a new service to ensure PlugX persists on the system when delivered as another payload onto the system.

RDAT has created a service when it is installed on the victim machine.

To establish persistence, Okrum can install itself as a new service named NtmSsvc.

Kazuar can install itself as a new service.

Ragnar Locker has used sc.exe to create a new service for the VirtualBox driver.

One variant of BlackEnergy creates a new service using either a hard-coded or randomly generated name.

zwShell has established persistence by adding itself as a new service.