Procedure examples

Some InnaputRAT variants create a new Windows service to establish persistence.

ZxShell can create a new service using the service parser function ProcessScCommand.

Winnti for Windows sets its DLL file as a new service in the Registry to establish persistence.

AppleJeus can install itself as a service.

STARWHALE has the ability to create the following Windows service to establish persistence on an infected host: `sc create Windowscarpstss binpath= "cmd.exe /c cscript.exe c:\\windows\\system32\\w7_1.wsf humpback_whale" start= "auto" obj= "LocalSystem"`.

Industroyer can use an arbitrary system service to load at system boot for persistence and replaces the ImagePath registry value of a Windows service with a new backdoor binary.

One persistence mechanism used by CozyCar is to register itself as a Windows service.

QakBot can remotely create a temporary service on a target host.

Gelsemium can drop itself in `C:\Windows\System32\spool\prtprocs\x64\winprint.dll` as an alternative Print Processor to be loaded automatically when the spoolsv Windows service starts.

Dtrack can add a service called WBService to establish persistence.

LoudMiner can automatically launch a Linux virtual machine as a service at startup if the AutoStart option is enabled in the VBoxVmService configuration file.

BitPaymer has attempted to install itself as a service to maintain persistence.

SLOTHFULMEDIA has created a service on victim machines named "TaskFrame" to establish persistence.

FALLCHILL has been installed as a Windows service.

SILENTTRINITY can establish persistence by creating a new service.

PowerSploit contains a collection of Privesc-PowerUp modules that can discover and replace/modify service binaries, paths, and configs.

Empire can utilize built-in modules to modify service binaries and restore them to their original state.

Remcos can terminate, suspend, and resume a process by PID.

PsExec can leverage Windows services to escalate privileges from administrator to SYSTEM with the -s argument.

Duqu creates a new service that loads a malicious driver when the system starts. When Duqu is active, the operating system believes that the driver is legitimate, as it has been signed with a valid private key.

During the 3CX Supply Chain Attack, AppleJeus installs a Launch Daemon to execute the POOLRAT macOS backdoor software.

COATHANGER will create a daemon for timed check-ins with command and control infrastructure.

Dacls can establish persistence via a Launch Daemon.

The REPTILE launcher can daemonize a process.

Green Lambert can add a plist file in the `Library/LaunchDaemons` to establish persistence.

When running with root privileges after a Launch Agent is installed, ThiefQuest installs a plist file to the /Library/LaunchDaemons/ folder with the RunAtLoad key set to true establishing persistence as a Launch Daemon.

Bundlore can persist via a LaunchDaemon.

If running with root permissions, OSX_OCEANLOTUS.D can create a persistence file in the folder /Library/LaunchDaemons.

XCSSET uses the ssh launchdaemon to elevate privileges, bypass system controls, and enable remote access to the victim.

AppleJeus has placed a plist file within the LaunchDaemons folder and launched it manually.

LoudMiner adds plist files with the naming format com.[random_name].plist in the /Library/LaunchDaemons folder with the RunAtLoad and KeepAlive keys set to true.

KV Botnet Activity involves managing events on victim systems via libevent to execute a callback function when any running process contains the following references in their path without also having a reference to bioset: busybox, wget, curl, tftp, telnetd, or lua. If the bioset string is not found, the related process is terminated.

UPSTYLE creates a `.pth` file beginning with the text `import` so that any time another process or script attempts to reference the modified item the malicious code will also run.

XCSSET's `dfhsebxzod` module searches for `.xcodeproj` directories within the user’s home folder and subdirectories. For each match, it locates the corresponding `project.pbxproj` file and embeds an encoded payload into a build rule, target configuration, or project setting. The payload is later executed during the build process.

Pacu can set up S3 bucket notifications to trigger a malicious Lambda function when a CloudFormation template is uploaded to the bucket. It can also create Lambda functions that trigger upon the creation of users, roles, and groups.

Mini Shai-Hulud has modified settings and configuration files of AI coding agents and other coding applications in order to create event triggered executions through creating hooks and runOn conditions.

Kimsuky has a HWP document stealer module which changes the default program association in the registry to open HWP documents.

SILENTTRINITY can conduct an image hijack of an `.msc` file extension as part of its UAC bypass process.

Gazer can establish persistence through the system screensaver by configuring it to execute the malware.

During Operation Ghost, APT29 used WMI event subscriptions to establish persistence for malware.

During the SolarWinds Compromise, APT29 used a WMI event filter to invoke a command-line event consumer at system boot time to launch a backdoor with `rundll32.exe`.

Mustang Panda's custom ORat tool uses a WMI event consumer to maintain persistence.

Leviathan has used WMI for persistence.

Blue Mockingbird has used mofcomp.exe to establish WMI Event Subscription persistence mechanisms configured from a *.mof file.

Turla has used WMI event filters and consumers to establish persistence.

APT29 has used WMI event subscriptions for persistence.

Metador has established persistence through the use of a WMI event subscription combined with unusual living-off-the-land binaries such as `cdb.exe`.

HEXANE has used WMI event subscriptions for persistence.

Rancor has complied VBScript-generated MOF files into WMI event subscriptions for persistence.

APT33 has attempted to use WMI event subscriptions to establish persistence on compromised hosts.