Persistence
Persistence techniques allow adversaries to maintain access to your environment across restarts, credential changes, and defensive responses. Detecting persistence mechanisms is critical to preventing long-dwell intrusions.
Coverage
- Techniques covered
- 19
- Detection rules
- 45
- Data sources
- 8+
Threat context
How adversaries maintain persistent access
After initial access, adversaries immediately establish persistence before executing their primary objective. In cloud environments, this often means creating a new IAM user or adding an access key to an existing one — actions that survive password resets. In on-premises Active Directory environments, attackers create rogue accounts, add themselves to privileged groups, or deploy services that execute on boot.
The most dangerous persistence mechanisms are those that modify authentication itself: adding a new SAML provider, registering a new MFA factor, or inserting a backdoor into the PAM stack. These changes allow adversaries to authenticate as any user, surviving even complete credential rotation across the environment.
Techniques
Persistence techniques ManySignal detects
Valid Accounts
Attacker creates or reuses valid credentials to survive password resets.
Account Manipulation
Adding cloud credentials, email delegates, or SSH keys to maintain access.
Create Account
Rogue local, domain, or cloud accounts created for persistent access.
Create or Modify System Process
New services or launchd jobs that survive reboots.
Event Triggered Execution
Registry run keys, AppInit DLLs, and component object model hijacking.
Modify Authentication Process
Manipulating MFA factors, SAML providers, or PAM modules for persistent auth bypass.
Persistence: frequently asked questions
What is ATT&CK Persistence (TA0003)?
Persistence techniques ensure an adversary's access survives reboots, credential rotations, and other interruptions. Detecting persistence early prevents long-dwell intrusions where attackers establish multiple redundant footholds.
How do attackers establish persistence in cloud environments?
In AWS and Azure, attackers create new IAM users or access keys, assign admin roles to compromised accounts, or modify federated identity providers. In SaaS, they register new MFA factors or create OAuth app permissions that survive password resets.
What ManySignal detections cover persistence?
ManySignal ships 45+ persistence detections including new IAM access key creation, rogue admin role grants, SSH key additions, scheduled task creation, and MFA factor registration from unusual locations.
How quickly can an attacker establish persistence after initial access?
In cloud environments, an attacker with stolen credentials can establish persistence within seconds — creating a new access key or adding themselves to an admin group is a single API call. ManySignal's detection latency for these events is under 2 minutes.
Catch persistence before attackers entrench
ManySignal detects persistence mechanisms within seconds of creation — before attackers have time to deploy additional footholds.