The following table contains all the techniques covered and whether or not administrator rights are needed to establish persistence.

NoTechniqueMITRE IDAdministrator Rights
1Registry Run KeysNo
2Service Registry Permission WeaknessNo
3Scheduled TasksNo
4Shortcut ModificationNo
5BITS JobsNo
6PowerShell ProfileNo
7ScreensaverNo
8Component Object Model HijackingNo
9Change Default File AssociationNo
10Office Application StartupNo
11Visual Studio Code ExtensionsNo
12ExplorerNo
13WinLogon Helper DLLYes
14RID HijackingYes
15Time ProvidersYes
16Image File Execution Options InjectionYes
17Application ShimmingYes
18DLL Search Order HijackingYes
19AppInit DLLsYes
20Netsh Helper DLLYes
21Accessibility FeaturesYes
22Port MonitorsYes
23Security Support ProviderYes
24AMSIYes
25WMI Event SubscriptionYes
26Print SpoolerYes
27CertificatesYes
28Notepad++Yes
29Event LogYes
30Event Log Online HelpYes
31Context MenuYes
32Service Control ManagerYes
33Windows TelemetryYes
34Scheduled Task TamperingYes
35Disk Clean UpYes
36Windows Setup ScriptYes
37WaitforYes
38New ServiceYes
39Modifying Existing ServiceYes
40DLL Proxy LoadingNo

Leave a comment