What is persistence?¶
Persistence is a method used to maintain access to a system, account or service after the original route is lost or interrupted.
Avoid the dangerous assumption¶
The dangerous assumption is that continued access must mean the original password, vulnerability or session still works.
It may not.
Persistence can be created through:
- new user accounts
- scheduled tasks
- services
- startup items
- authentication tokens
- application consent
- browser extensions
- web shells
- remote-access software
- modified configuration
- compromised administrator access.
The purpose is to survive events such as restart, password reset, session termination, patching or the loss of the original device.
Investigators should identify:
- what mechanism was created
- when it was created
- which account or process created it
- what access it provided
- whether it was triggered or used
- whether it remained after containment.
The presence of a persistence mechanism does not prove that it was used.
A scheduled task may never have run.
A token may have expired.
A web shell may have remained untouched.
Likewise, continuing access does not automatically prove deliberate persistence. A valid account, shared credential or legitimate service may explain it.
Preserve the mechanism and its configuration before removal. Record any associated file, account, command, identifier, target and trigger.
Creation time may help reconstruct the incident, but timestamps can be altered or affected by system behaviour.
Persistence may also outlive the original offender. Another person may later discover and use the same foothold.
Operational takeaway¶
Identify the mechanism, creator, trigger and use of persistence, and prove continued access separately from the mechanism’s mere presence.