Procedure examples

Remexi achieves persistence using Userinit by adding the Registry key HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit.

PowerSploit's Install-SSP Persistence module can be used to establish by installing a SSP DLL.

Empire can enumerate Security Support Providers (SSPs) as well as utilize PowerSploit's Install-SSP and Invoke-Mimikatz to install malicious SSPs and log authentication events.

The Mimikatz credential dumper contains an implementation of an SSP.

Skidmap has the ability to install several loadable kernel modules (LKMs) on infected machines.

The REPTILE rootkit is implemented as a loadable kernel module (LKM).

Drovorub can use kernel modules to establish persistence.

Wingbird drops a malicious file (sspisrv.dll) alongside a copy of lsass.exe, which is used to register a service that loads sspisrv.dll as a driver. The payload of the malicious driver (located in its entry-point function) is executed when loaded by lsass.exe before the spoofed service becomes unstable and crashes.

Pasam establishes by infecting the Security Accounts Manager (SAM) DLL to load a malicious DLL dropped to disk.

RedLeaves attempts to add a shortcut file in the Startup folder to achieve persistence.

To establish persistence, SslMM identifies the Start Menu Startup directory and drops a link to its own executable disguised as an “Office Start,” “Yahoo Talk,” “MSN Gaming Z0ne,” or “MSN Talk” shortcut.

InvisiMole can use a .lnk shortcut for the Control Panel to establish persistence.

Okrum can establish persistence by creating a .lnk shortcut to itself in the Startup folder.

MarkiRAT can modify the shortcut that launches Telegram by replacing its path with the malicious payload to launch with the legitimate executable.

Kazuar adds a .lnk file to the Windows startup folder.

The BlackEnergy 3 variant drops its main DLL component and then creates a .lnk shortcut to that file in the startup folder.

Reaver creates a shortcut file and saves it in a Startup folder to establish persistence.

S-Type may create the file %HOMEPATH%\Start Menu\Programs\Startup\Realtek {Unique Identifier}.lnk, which points to the malicious `msdtc.exe` file already created in the `%CommonFiles%` directory.

SeaDuke is capable of persisting via a .lnk file stored in the Startup directory.

Gazer can establish persistence by creating a .lnk file in the Start menu or by modifying existing .lnk files to execute the malware through cmd.exe.

A version of KONNI drops a Windows shortcut on the victim’s machine to establish persistence.

SPACESHIP achieves persistence by creating a shortcut in the current user's Startup folder.

Micropsia creates a shortcut to maintain persistence.

RogueRobin establishes persistence by creating a shortcut (.LNK file) in the Windows startup folder to run a script each time the user logs in.

Grandoreiro can write or modify browser shortcuts to enable launching of malicious browser extensions.

Bazar can establish persistence by writing shortcuts to the Windows Startup folder.

SHIPSHAPE achieves persistence by creating a shortcut in the Startup folder.

TinyZBot can create a shortcut in the Windows startup folder for persistence.

FELIXROOT creates a .LNK file for persistence.

Astaroth's initial payload is a malicious .LNK file.

Helminth establishes persistence by creating a shortcut.

Comnie establishes persistence via a .lnk file in the victim’s startup path.

BACKSPACE achieves persistence by creating a shortcut to itself in the CSIDL_STARTUP directory.

Empire can persist by modifying a .LNK file to include a backdoor.

The PipeMon installer has modified the Registry key HKLM\SYSTEM\CurrentControlSet\Control\Print\Environments\Windows x64\Print Processors to install PipeMon as a Print Processor.

Gelsemium can drop itself in C:\Windows\System32\spool\prtprocs\x64\winprint.dll to be loaded automatically by the spoolsv Windows service.

When executing with user-level permissions, RotaJakiro can install persistence using a .desktop file under the `$HOME/.config/autostart/` folder.

InvisibleFerret has established persistence within GNOME-based Linux environments by placing entries within `.desktop` that run on Startup.

NETWIRE can use XDG Autostart Entries to establish persistence on Linux systems.

If executing without root privileges, Fysbis adds a `.desktop` configuration file to the user's `~/.config/autostart` directory.

CrossRAT can use an XDG Autostart to establish persistence.

Pupy can use an XDG Autostart to establish persistence.

PoisonIvy creates a Registry key in the Active Setup pointing to a malicious executable.

NETWIRE can persist via startup options for Login items.

Green Lambert can add Login Items to establish persistence.

Dok uses AppleScript to install a login Item by sending Apple events to the System Events process.

Raspberry Robin implements a variation of the ucmDccwCOMMethod technique abusing the Windows AutoElevate backdoor to bypass UAC while elevating privileges.

Exaramel for Linux can execute commands with high privileges via a specific binary with setuid functionality.

Keydnap adds the setuid flag to a binary so it can easily elevate in the future.

RCSession can bypass UAC to escalate privileges.