What Persistent Footholds Are and How Attackers Use Them
Summary
An explainer describes persistent footholds as mechanisms that re-trigger malware after interruptions, including Windows scheduled tasks and other autoruns, and explains how human threat hunters can identify malicious persistence without disrupting legitimate system or-
Key points
- A persistent foothold lets malware run again after interruptions such as a reboot or user logoff, maintaining an attacker's ability to execute code.
- Attackers can abuse operating-system autoruns, including startup items, registry run keys, WMI events and scheduled tasks.
- The article's example uses a Windows scheduled task to run a renamed mshta.exe, which calls VBScript and then PowerShell.
- Human threat hunters can help distinguish malicious autoruns from legitimate ones; incorrectly disabling legitimate entries can disrupt the operating system or applications.
Article Details
- Topic
- Persistent footholds and threat hunting
MITRE ATT&CK
T1053 · Scheduled Task/JobThe article describes scheduled tasks as autoruns that attackers can use to automatically execute malware and maintain persistence.T1546.003 · Windows Management Instrumentation Event SubscriptionThe article identifies WMI events as a mechanism that can be used to create persistence.T1547.001 · Registry Run Keys / Startup FolderThe article identifies run keys and startup items as autoruns attackers can use to maintain persistence.