Hunting Persistence Mechanisms on Windows

When to Use

• You are hunting for how an adversary maintains a foothold across reboots.
• You have autostart inventories (Autoruns exports, registry/scheduled-task/WMI dumps) from one or many hosts and want to surface anomalies.
• You want to baseline a fleet and flag entries that deviate or were recently added.

Do not use a single host's autoruns list as ground truth — many legitimate entries look unusual; comparison against a fleet baseline is what makes anomalies meaningful.

Prerequisites

• Autostart data per host: Run/RunOnce keys, services, scheduled tasks, WMI event subscriptions, startup folders, and (ideally) signing status.
• A baseline (golden image or fleet majority) to diff against.

Workflow

Step 1: Inventory the ASEPs

Collect the common Autostart Extensibility Points across hosts: Run keys (T1547.001), services (T1543.003), scheduled tasks (T1053.005), and WMI subscriptions (T1546.003).

Step 2: Baseline and diff

Compare each host's entries to the fleet baseline; entries appearing on few hosts, unsigned, or pointing to user-writable/temp paths bubble up.

python scripts/analyst.py hunt autostart.json --baseline baseline.json

Step 3: Score anomalies

Raise priority for: unsigned binaries, LOLBins launched with encoded args, paths in %TEMP%/%APPDATA%, recently created tasks, and WMI consumers running scripts.

Step 4: Triage candidates

For each high-score entry, pull the target binary's signing/hash, the creating user/time, and correlate with process and network telemetry.

Step 5: Confirm and respond

Validate suspicious entries (sandbox/RE the binary), escalate confirmed persistence to IR, and turn the pattern into a detection.

Validation

• Anomalies are ranked against a baseline, not flagged from one host in isolation.
• High-score entries map to concrete artifacts (path, hash, signer) for triage.
• Confirmed persistence ties back to a known intrusion timeline.

Pitfalls

• Treating every unsigned entry as malicious; many legitimate tools are unsigned.
• Checking only Run keys and missing services/tasks/WMI subscriptions.
• No timestamps, so you cannot distinguish long-standing from newly planted entries.

References

• See references/api-reference.md for the autostart hunter.
• ATT&CK Persistence tactic and Autoruns (linked in frontmatter).