← All cheat sheets

WINDOWS PERSISTENCE LOCATIONS

Plain-text reference · 6 KB. Read it, search it (Ctrl-F) or print it.

A triage reference of WHERE malware and attackers establish persistence on
Windows, and how to inspect each location defensively. This is for hunting
and investigation (where to look), NOT for implanting persistence.

Tooling note: Sysinternals Autoruns (autorunsc.exe) enumerates nearly all of
these in one pass -- run it with -accepteula and check VirusTotal + signer.

1. REGISTRY RUN / RUNONCE KEYS (ATT&CK T1547.001)#

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
HKLM\...\Policies\Explorer\Run
HKLM\SOFTWARE\Wow6432Node\...\CurrentVersion\Run   (32-bit on 64-bit)
Inspect:
  reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run"
  Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run'
Flags: entries pointing to %TEMP%, %APPDATA%, scripting hosts, or encoded
commands; unsigned binaries.

2. STARTUP FOLDERS#

%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup   (per user)
%ProgramData%\Microsoft\Windows\Start Menu\Programs\Startup (all users)
Inspect: list contents; .lnk shortcuts pointing to odd targets, scripts,
or LOLBins are suspicious.

3. SERVICES (ATT&CK T1543.003 / T1569.002)#

HKLM\SYSTEM\CurrentControlSet\Services\<name>
Key values: ImagePath, Start (2=auto), ServiceDll (for svchost services).
Inspect:
  sc query type= service state= all
  sc qc <servicename>
  Get-CimInstance Win32_Service | Select Name,State,StartMode,PathName
Event log: System 7045 (new service installed), Security 4697.
Flags: ImagePath in a user/temp dir, unsigned binary, service name
masquerading as a system service, ServiceDll pointing to a rogue DLL.

4. SCHEDULED TASKS (ATT&CK T1053.005)#

On disk: C:\Windows\System32\Tasks\ (XML files), and
  HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks
Inspect:
  schtasks /query /fo LIST /v
  Get-ScheduledTask | Where State -ne 'Disabled'
  (export the Actions to see the command run)
Event log: Microsoft-Windows-TaskScheduler/Operational (106 created,
140 updated, 200 action run); Security 4698 (task created).
Flags: tasks running scripting hosts/LOLBins, odd triggers (at logon/idle),
hidden tasks, tasks created recently around the incident window.

5. WMI EVENT SUBSCRIPTIONS (ATT&CK T1546.003)#

Namespace root\subscription. Three linked objects:
  __EventFilter      (the trigger/query)
  CommandLineEventConsumer / ActiveScriptEventConsumer (the payload)
  __FilterToConsumerBinding (ties them together)
Inspect:
  Get-WmiObject -Namespace root\subscription -Class __EventFilter
  Get-WmiObject -Namespace root\subscription -Class CommandLineEventConsumer
  Get-WmiObject -Namespace root\subscription -Class __FilterToConsumerBinding
Event log: Sysmon 19/20/21 (WMI filter/consumer/binding).
Flags: any consumer running powershell/cmd/script; fileless persistence hides
here and survives reboot.

6. LOGON SCRIPTS / USERINIT / SHELL (ATT&CK T1037 / T1547)#

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
  Userinit  (should be userinit.exe,)   Shell (should be explorer.exe)
HKCU\Environment\UserInitMprLogonScript   (logon script)
Flags: extra entries appended after userinit.exe/explorer.exe,
or a Shell value pointing elsewhere.

7. IMAGE FILE EXECUTION OPTIONS / DEBUGGERS (T1546.012)#

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\
  Image File Execution Options\<exe>\Debugger
HKLM\...\SilentProcessExit\<exe>\MonitorProcess
Flags: a "Debugger" value on common binaries (e.g. sethc.exe, utilman.exe)
hijacks their launch. Accessibility-binary hijacks are a classic check.

8. COM HIJACKING (ATT&CK T1546.015)#

HKCU\SOFTWARE\Classes\CLSID\<guid>\InprocServer32  (user-writable, wins over HKLM)
Flags: a user-hive CLSID entry overriding a system COM object, pointing to a
rogue DLL in a user/temp path.

9. APPINIT / APP PATHS / KNOWN DLLS (DLL load persistence)#

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs
HKLM\SOFTWARE\...\App Paths\<exe>
Flags: non-empty AppInit_DLLs with LoadAppInit_DLLs=1 (mostly legacy/disabled
on modern Windows, but still worth a glance).

10. LOCAL ACCOUNTS & GROUPS (ATT&CK T1136)#

Inspect:
  net user
  net localgroup Administrators
  Get-LocalUser ; Get-LocalGroupMember Administrators
Event log: Security 4720 (user created), 4732 (added to local group).
Flags: new/unexpected local admins, recently created accounts, accounts with
names mimicking service/system accounts.

11. SSH / OPENSSH (if installed) & RDP ALLOW#

%ProgramData%\ssh\administrators_authorized_keys and user
  %USERPROFILE%\.ssh\authorized_keys -- added keys = persistence.
Check RDP enablement and Remote Desktop Users group membership.

12. DRIVERS / BOOT (ATT&CK T1547.006)#

HKLM\SYSTEM\CurrentControlSet\Services\<driver> (Type=1 kernel driver)
Inspect: driverquery /v ; fltmc filters
Flags: unsigned drivers, drivers loaded from non-standard paths.

FAST TRIAGE PASS#

1. autorunsc.exe -accepteula -a * -h -s -c  (CSV: all categories, hashes,
   signer, verify -- then check unsigned/temp-path/unverified entries).
2. Scheduled tasks (schtasks /query /v) + Services (sc query state= all) +
   Run keys (reg query) for anything in temp/appdata or unsigned.
3. WMI subscriptions (root\subscription) for fileless persistence.
4. New local accounts / admin group changes (Security 4720/4732).
5. Correlate creation times with the incident window; hash and submit
   suspicious binaries for reputation.

Technique mapping follows the MITRE ATT&CK Persistence tactic;
locations follow Microsoft documentation and Sysinternals Autoruns
coverage.

Defensive reference on CyberRamen. Offensive / red-team sheets live on OffensiveRamen.com.