Persistence Named
Persistence mechanism literacy on $LAB_RT under written RoE — names and defender detections, not stranger-host implant cookbooks.
Visual · t21_persistence_named
Persistence = survive reboot on authorized lab host. $LAB_RT RoE only. Original Cyberlium.
Learn what persistence means in ATT&CK so blue can detect it — not how to hide on networks you never got permission to touch.
Persistence techniques help adversaries maintain access after reboot or credential rotation — registry run keys, scheduled tasks, services, startup folders, WMI subscriptions, and similar T1547/T1053-class patterns. Red-team literacy names these categories, maps them to emulation objectives in YOUR written RoE, and documents what defenders should alert on. Cyberlium teaches persistence as named concepts plus detection value on $LAB_RT hosts listed in engagement scope — NOT implant recipes for employer laptops, NOT backdoors on classmate VMs, NOT 'stay forever' goals outside signed objectives. Validation = document which technique class you would emulate in lab and which log source would fire — stop at literacy or brief-approved lab action per RoE teardown rules.
1. Persistence categories (literacy)
Boot or logon autostart, scheduled tasks, service creation, DLL search-order abuse — name the ATT&CK technique ID in notes.
Red-team question: does RoE allow this persistence class for the exercise window, and what is the mandatory teardown?
Command guide
Try these commands — Persistence categories (literacy)
═══ LINUX / macOS (Terminal Practice) ═══
Check system state and user context
Command — copy this
id whoami uname -a
Inspect network sockets listening for connections
Command — copy this
ss -tuln 2>/dev/null || netstat -tuln
Audit active processes
Command — copy this
ps aux | grep -v "\[" | head -15
═══ WINDOWS (POWERSHELL) ═══ Query user identity and system information
Command — copy this
whoami /all Get-ComputerInfo | Select-Object CsName, OsName, OsVersion
Primary tools to practice this lesson: crontab, grep. Reference sites: Persistence tactic (https://attack.mitre.org/tactics/TA0003/); MITRE ATT&CK (https://attack.mitre.org/techniques/enterprise/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Defender detections
Monitor new services, Run/RunOnce changes, suspicious scheduled tasks, WMI persistence, Sysmon Event ID patterns.
Purple value: one persistence class → one detection rule hypothesis → one log source — not silent implants on strangers.
3. RoE boundary
Persistence emulation only on $LAB_RT hosts named in written RoE with time box and revert plan.
No persistence on daily-driver OS, café PCs, cloud tenants without engagement, or 'practice' on neighbor AD.
4. What you ship: persistence literacy card
Three persistence classes + ATT&CK IDs + two detection sources + $LAB_RT-only sentence.
5. What you record before the next lesson
Persistence literacy card path.
6. Wrong vs right: stranger phishing vs authorized RT lab
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
- Wrong: Deploy autostart persistence on roommate Windows box 'for red-team practice.'
- Right: Name persistence classes and detections on RoE lab. Next: LOLBins Named.
Mission: persistence literacy card
1) Define persistence in one line. 2) Name three mechanism classes with ATT&CK IDs. 3) Write two defender log sources. 4) Write NEVER on unauthorized hosts.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Which persistence classes are in-scope for my RoE?”
APPLY: Persistence on Cyberlium means:
APPLY: True or False: Persistence on stranger laptops is red-team practice.
APPLY: Defenders detect persistence via: