Attacks and malware
What is Persistence?
Anything the attacker leaves behind so their access survives a reboot or a logout.
Persistence is anything an attacker sets up so that their access survives a reboot, a password change or a logout. It is a tactic in MITRE ATT&CK with many techniques beneath it.
Common methods include scheduled tasks, services, registry Run keys, startup folders, web shells, new accounts and stolen cloud tokens. Finding and removing every persistence mechanism is a core part of incident response, because missing one means the attacker is still in.