Dictionary · Hacking Techniques and Methodologies
Persistence
Post-access · Advanced
Keeping unauthorized access after a reboot or a password change. Defenders watch for unexpected scheduled tasks, new services, and unfamiliar startup programs.
The goal of the defender is to notice a mechanism that survives cleanup. A new service or scheduled task that nobody requested is a clue worth investigating.
Example: A server has a scheduled task the change record does not explain. Incident response treats it as possible persistence and removes it after confirming it is unwanted.
Common misconception
- A startup program is not automatically malicious. The signal is that it is unexpected and unexplained.