Procedure examples

TeamTNT has used malware that adds cryptocurrency miners as a service.

FIN7 created new Windows services and added them to the startup directories for persistence.

OilRig has used a compromised Domain Controller to create a service on a remote host.

Carbanak malware installs itself as a service to provide persistence and SYSTEM privileges.

Tropic Trooper has installed a service pointing to a malicious DLL dropped to disk.

Aquatic Panda created new Windows services for persistence that masqueraded as legitimate Windows services via name change.

Ke3chang backdoor RoyalDNS established persistence through adding a service called Nwsapagent.

Blue Mockingbird has made their XMRIG payloads persistent as a Windows Service.

DarkVishnya created new services for shellcode loaders distribution.

Lotus Blossom has configured tools such as Sagerunex to run as Windows services.

Cinnamon Tempest has created system services to establish persistence for deployed tooling.

Medusa Group has used vulnerable or signed drivers to modify security solutions on victim devices.

Agrius has deployed IPsec Helper malware post-exploitation and registered it as a service for persistence.

Several Lazarus Group malware families install themselves as new services.

Earth Lusca created a service using the command sc create “SysUpdate” binpath= “cmd /c start “[file path]””&&sc config “SysUpdate” start= auto&&net
start SysUpdate for persistence.

Cobalt Group has created new services to establish persistence.

Wizard Spider has installed TrickBot as a service named ControlServiceA in order to establish persistence.

PROMETHIUM has created new services and modified existing services for persistence.

Threat Group-3390's malware can create a new service, sometimes naming it after the config information, to gain persistence.

An APT19 Port 22 malware variant registers itself as a service.

Kimsuky has a HWP document stealer module which changes the default program association in the registry to open HWP documents.

Mustang Panda's custom ORat tool uses a WMI event consumer to maintain persistence.

Leviathan has used WMI for persistence.

Blue Mockingbird has used mofcomp.exe to establish WMI Event Subscription persistence mechanisms configured from a *.mof file.

Turla has used WMI event filters and consumers to establish persistence.

APT29 has used WMI event subscriptions for persistence.

Metador has established persistence through the use of a WMI event subscription combined with unusual living-off-the-land binaries such as `cdb.exe`.

HEXANE has used WMI event subscriptions for persistence.

Rancor has complied VBScript-generated MOF files into WMI event subscriptions for persistence.

APT33 has attempted to use WMI event subscriptions to establish persistence on compromised hosts.

FIN8 has used WMI event subscriptions for persistence.

Contagious Interview has targeted macOS victim hosts using a bash downloader `coremedia.sh` and a bash script `cloud.sh`.

APT3 replaces the Sticky Keys binary C:\Windows\System32\sethc.exe for persistence.

APT41 leveraged sticky keys to establish persistence.

APT29 used sticky-keys to obtain unauthenticated, privileged console access.

Axiom actors have been known to use the Sticky Keys replacement within RDP sessions to obtain persistence.

Deep Panda has used the sticky-keys technique to bypass the RDP login screen on remote systems during intrusions.

Fox Kitten has used sticky keys to launch a command prompt.

APT39 has used malware to set LoadAppInit_DLLs in the Registry key SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows in order to establish persistence.

FIN7 has used application shim databases for persistence.

Turla has used PowerShell profiles to maintain persistence on an infected machine.

APT28 has used COM hijacking for persistence by replacing the legitimate MMDeviceEnumerator object with a payload.

TeamPCP has modified software packages with preinstall scripts to download and execute malicious payloads.

APT42 has modified the Registry to maintain persistence.

BlackByte has used Registry Run keys for persistence.

APT3 places scripts in the startup folder for persistence.

Kimsuky has placed scripts in the startup folder for persistence and modified the `HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce` Registry key.

Patchwork has added the path of its second-stage malware to the startup folder to achieve persistence. One of its file stealers has also persisted by adding a Registry Run key.

APT41 created and modified startup files for persistence. APT41 added a registry key in HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost to establish persistence for Cobalt Strike.

Dragonfly has added the registry value ntdll to the Registry Run key to establish persistence.