What evidence may show malware persistence?¶
Malware persistence means a mechanism was created to allow malicious activity to survive interruption, restart or loss of the original access route.
Avoid the dangerous assumption¶
The dangerous assumption is that any startup item or scheduled task is malicious persistence.
Legitimate software uses the same mechanisms.
Possible persistence evidence includes:
- scheduled tasks
- services
- startup items
- registry run keys
- login scripts
- browser extensions
- new accounts
- authentication tokens
- web shells
- modified system components
- remote-management tools.
Investigators should identify:
- when the mechanism was created
- which account created it
- what it launches or enables
- whether it ran
- whether it survived restart
- whether it remained after password reset
- what records link it to the wider incident.
The presence of persistence does not prove it was used.
A task may have been created but never triggered.
A service may have failed.
A token may have expired.
Likewise, continuing access does not automatically prove malware persistence. Stolen credentials or legitimate remote services may explain it.
Preserve the configuration and associated payload before removal.
Record any remediation action because deleting the mechanism may change the evidence.
The creation time may help define the incident timeline, but timestamps can be affected by system behaviour or manipulation.
Persistence may be created by malware, an interactive offender or a compromised administrator account. The mechanism can establish continued access without proving which person created or later used it.
Creation and use may involve different actors.
Operational takeaway¶
Identify the mechanism, creator, target and execution history, and prove persistence use separately from its mere presence.