CRITICAL

Multi-Vector Persistence

Interactive simulation and visual analysis of the attack vector.

01Registry Run Keys

The simplest and most common form of Windows persistence. Malware writes its file path to HKCU\Software\Microsoft\Windows\CurrentVersion\Run so it executes every time the user logs in.

Registry Editor

Computer\HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

HKEY_CLASSES_ROOT
HKEY_CURRENT_USER
HKEY_LOCAL_MACHINE
- Software
  - Microsoft
    - Windows
      - CurrentVersion
        Run
        RunOnce
HKEY_USERS

Name	Type	Data
(Default)	REG_SZ	(value not set)
SecurityHealth	REG_EXPAND_SZ	%windir%\system32\SecurityHealthSystray.exe

02WMI & Scheduled Tasks

For deeper lateral persistence, malware weaponizes Windows Management Instrumentation (WMI) event subscriptions or the Task Scheduler to trigger fileless payloads upon system boot or inactivity.

Windows Task Scheduler (Weaponized)

Task Scheduler Library

Name	Status	Triggers	Next Run Time	Action
Adobe Acrobat Update	Ready	Every day at 12:00 PM	12:00:00 PM	C:\Program Files\...
GoogleUpdateTask	Ready	At log on of any user	N/A	C:\Program Files (x86)\...

03Service Hijacking

Advanced malware with Administrator privileges installs itself as a background Windows Service. This guarantees it runs immediately on boot and executes as 'NT AUTHORITY\SYSTEM', the highest privilege level.

root@kali:~# msfconsole

meterpreter > shell

Process 8102 created.

Channel 1 created.

Services (Local)

Name	Description	Status	Startup Type	Log On As
Windows Audio	Manages audio for Windows...	Running	Automatic	Local Service
Windows Defender	Helps protect your computer...	Running	Automatic	Local System