Windows - Persistence

Content of this page has been moved to InternalAllTheThings/redteam/persistence/windows

• Tools
• Hide Your Binary
• Disable Antivirus and Security
  • Antivirus Removal
  • Disable Windows Defender
  • Disable Windows Firewall
  • Clear System and Security Logs
• Simple User
  • Registry HKCU
  • Startup
  • Scheduled Tasks User
  • BITS Jobs
• Serviceland
  • IIS
  • Windows Service
• Elevated
  • Registry HKLM
    • Winlogon Helper DLL
    • GlobalFlag
  • Startup Elevated
  • Services Elevated
  • Scheduled Tasks Elevated
  • Binary Replacement
    • Binary Replacement on Windows XP+
    • Binary Replacement on Windows 10+
  • RDP Backdoor
    • utilman.exe
    • sethc.exe
  • Remote Desktop Services Shadowing
  • Skeleton Key
  • Virtual Machines
  • Windows Subsystem for Linux
• Domain
  • Golden Certificate
  • Golden Ticket
• References