Does the presence of persistence prove it was used?¶
No. The presence of a persistence mechanism does not automatically prove that it was used.
Avoid the dangerous assumption¶
The dangerous assumption is that creation, capability and use are the same event.
They are not.
A scheduled task may never trigger.
A service may fail to start.
A token may expire.
A browser extension may remain inactive.
A new account may never authenticate.
A web shell may receive no requests.
Investigators should look for execution or use evidence.
That may include:
- process records
- authentication events
- task history
- service starts
- API calls
- web requests
- network connections
- file or account actions
- session activity.
The absence of use evidence does not always prove the mechanism was unused.
Logs may be incomplete, retention may have expired or the mechanism may have operated in memory.
Report the distinction accurately.
“The task was created” is different from “the task executed.”
“The account existed” is different from “the account was used.”
Persistence may still be evidentially important because it shows preparation, capability or intent, even where use cannot be proved.
Do not overstate the conclusion merely because the mechanism is commonly associated with malicious activity.
Where direct use cannot be shown, the timing and concealment of the mechanism may still support preparation or intent. That inference should be stated carefully and should not be converted into proof of later access.
That distinction should remain visible in the final report.
It matters.
Operational takeaway¶
Prove creation and use separately, and report persistence as capability or preparation where execution cannot be established.