Persistence is an objective, not a technique — anything that survives a defender’s attempt to remove access qualifies. MITRE ATT&CK catalogs the tactic across account manipulation, boot and logon autostart mechanisms, scheduled tasks, implants, browser extensions, cloud and identity modifications, and pre-OS-boot tampering.
The defensive consequence is asymmetric: one missed persistence mechanism invalidates an otherwise complete remediation. Effective response therefore treats persistence discovery as its own workstream — enumerating every mechanism the intrusion touched rather than cleaning only the ones that triggered detection.
Key points
Common mechanismsNew or modified accounts and credentials, autostart and boot modifications, scheduled tasks and services, implants and webshells, browser extensions, application and federation changes, and firmware or virtualization-layer tampering.
Eradication disciplineEnumerate persistence mechanisms systematically across endpoints, identity systems, and cloud planes; remove them together with the access they serve; and verify afterward rather than assuming completeness.
Layered retentionExpect deliberate redundancy — attackers commonly install several mechanisms at different layers precisely so that partial cleanup restores their access.
Important limitationPersistence mechanisms blend into legitimate administration, so lists built only from known-bad signatures miss them. Reimaging removes most host-level persistence but not mechanisms living in identity systems, firmware, or cloud control planes.