# What is Persistence?

> Persistence is the set of mechanisms an attacker uses to retain access to a compromised environment across reboots, credential resets, software updates, and partial remediation.

- Canonical URL: https://yellowcube.eu/glossary/persistence/
- Publisher: Yellow Cube
- Language: en
- Contact: hello@yellowcube.eu

## Content

Persistence is an objective, not a technique — anything that survives a defender’s attempt to remove access qualifies. MITRE ATT&CK catalogs the tactic across account manipulation, boot and logon autostart mechanisms, scheduled tasks, implants, browser extensions, cloud and identity modifications, and pre-OS-boot tampering.

The defensive consequence is asymmetric: one missed persistence mechanism invalidates an otherwise complete remediation. Effective response therefore treats persistence discovery as its own workstream — enumerating every mechanism the intrusion touched rather than cleaning only the ones that triggered detection.

### Key points

- **Common mechanisms:** New or modified accounts and credentials, autostart and boot modifications, scheduled tasks and services, implants and webshells, browser extensions, application and federation changes, and firmware or virtualization-layer tampering.
- **Eradication discipline:** Enumerate persistence mechanisms systematically across endpoints, identity systems, and cloud planes; remove them together with the access they serve; and verify afterward rather than assuming completeness.
- **Layered retention:** Expect deliberate redundancy — attackers commonly install several mechanisms at different layers precisely so that partial cleanup restores their access.
- **Important limitation:** Persistence mechanisms blend into legitimate administration, so lists built only from known-bad signatures miss them. Reimaging removes most host-level persistence but not mechanisms living in identity systems, firmware, or cloud control planes.

### Related terms

[Backdoor](<https://yellowcube.eu/glossary/backdoor/>) · [Rootkit](<https://yellowcube.eu/glossary/rootkit/>) · [Lateral movement](<https://yellowcube.eu/glossary/lateral-movement/>) · [Remote access trojan (RAT)](<https://yellowcube.eu/glossary/remote-access-trojan/>) · [Incident response (IR)](<https://yellowcube.eu/glossary/incident-response/>)

### Sources

[MITRE ATT&CK TA0003: Persistence](https://attack.mitre.org/tactics/TA0003/) · [NIST SP 800-83 Rev. 1: Guide to Malware Incident Prevention and Handling](https://csrc.nist.gov/pubs/sp/800/83/r1/final) · [NIST SP 800-61 Rev. 3: Incident Response Recommendations](https://csrc.nist.gov/pubs/sp/800/61/r3/final)

## Attribution and scope

This Markdown representation is generated from the same approved content records as the canonical HTML page. Cite the canonical URL above when referencing this material. Product and service descriptions are informational; confirm project-specific requirements with Yellow Cube.