What is cloud persistence?¶
Cloud persistence is any method that allows continued access to a cloud account or environment after the original entry point should have been removed.
It is how an attacker tries to stay present.
What this means in practice¶
Persistence can take many forms. An attacker may create a new user, add an administrator, register a trusted device, add a recovery method, grant a malicious application permission, issue an API key, create a service account or retain a refresh token.
They may also alter forwarding rules, sharing permissions, automation or identity-provider settings so that access continues indirectly.
For investigators, the key is to identify every change made after the first unauthorised access. Review user creation, role assignments, application consent, trusted devices, authentication methods, recovery details, API credentials, service accounts and active sessions.
Where compromise is active, containment may require coordinated removal of several access routes. Preserve the relevant records before making changes where operationally possible.
What this may show¶
In an organisational environment, compare provider audit logs with approved change records, help-desk tickets and administrator activity.
What this does not show on its own¶
The dangerous assumption is that securing the original account ends the compromise.
Persistence can survive a password reset because many of these access routes do not depend on the user’s current password.
What to do next¶
Look for changes that appear legitimate. Attackers may use names that resemble support accounts, administrators or normal applications.
Do not assume that persistence must involve a new account. A long-lived token or delegated permission may be enough.
Key takeaway
Cloud persistence is any retained or newly created route back into the environment, so investigate all identity, token, application and configuration changes after the initial compromise.