No Real Persistence
Persistence modules exist — course refuses them on real workstations and stranger nets.
Visual · msf_no_persistence
Persistence = survive reboot — refused outside disposable $LAB. Original Cyberlium.
If it survives reboot on a system you do not own, you crossed a bright line.
Metasploit includes persistence-oriented post/exploit support in the wild — Cyberlium will not teach registry autoruns, scheduled tasks, or firmware persistence on real hosts. On $LAB, revert snapshot instead of planting persistence. Defenders hunt persistence — learn IoC categories, not implant recipes.
1. What persistence means
Mechanisms that maintain access after reboot/logoff.
Legitimate admin tools overlap — context and authorization matter.
Command guide
Try these commands — What persistence means
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Persistence ethics — https://attack.mitre.org/tactics/TA0003/ Authorized testing — https://docs.rapid7.com/metasploit/msf-overview/
═══ INSTALL ═══
Linux (Debian/Ubuntu): Kali: preinstalled, or: sudo apt install metasploit-framework
macOS: Prefer Kali/Linux VM — brew install metasploit (heavy)
Windows: Use Kali VM or WSL with metasploit-framework — not raw Windows host
═══ LINUX / macOS ═══
Command — copy this
grep -i never "$HOME/cyberlium-lab/t14-msf/roe.txt" 2>/dev/null || true msfconsole -q -x 'search type:post name:persistence; exit' 2>/dev/null || echo 'Name techniques — REFUSE real-world persistence'
Primary tools to practice this lesson: msfconsole, grep. Reference sites: Persistence ethics (https://attack.mitre.org/tactics/TA0003/); Authorized testing (https://docs.rapid7.com/metasploit/msf-overview/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Course refusal
No persistence homework on personal PCs, work laptops, or cloud.
No ransomware staging “for lab.”
Snapshot revert replaces persistence on disposable VMs.
3. Defender hunt
Autoruns, services, cron, WMI subscriptions — monitor and baseline.
Persistence IoCs belong in capstone defender checklist.
4. What you ship: persistence refusal statement
Define persistence + NEVER on real systems + snapshot revert rule.
5. What you record before the next lesson
Refusal statement signed in notes.
6. Wrong vs right: stranger hosts vs YOUR lab VM
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
- Wrong: Install persistence on a friend's machine as a prank.
- Right: Refusal written. Next: post lab.
Mission: persistence refusal
1) Define persistence. 2) Write NEVER list (real PCs, ransomware, stranger nets). 3) Write revert-snapshot alternative for $LAB.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Persistence IoC examples for checklist?”
APPLY: Real workstation persistence:
APPLY: True or False: Ransomware prep is MSF homework.
APPLY: $LAB alternative to persistence: