Initial access is temporary. Persistence turns one successful intrusion into a reliable way back through a trigger, stored instruction, credential, service, or cloud grant that survives the defender's first interruption.
Persistence is not one artifact. It is a relationship between a stored instruction, a trigger, and the access it restores. A scheduled task waits for logon. A service waits for boot. An OAuth grant can issue fresh access without touching the endpoint at all.
This is why a password reset, process kill, or host isolation can appear successful while a separate re-entry layer remains intact. Analysts must identify the survival boundary of every mechanism they find.
| Mechanism | Trigger | What removes it |
|---|---|---|
| Scheduled task | Time, logon, boot, or event | Delete the task and its payload, then validate related triggers. |
| Run key | User logon | Remove the value and payload, then inspect adjacent autostart locations. |
| Windows service | System boot or service control | Stop and delete the service, remove the binary, and rebuild if trust is lost. |
| OAuth consent grant | Token refresh or application request | Revoke the grant, sessions, and refresh tokens, then review app credentials. |
| Mailbox rule | Message arrival | Remove the rule and forwarding target, then scope messages already redirected. |
Creation events are strongest when they connect to unusual lineage: a document or script host creating an ONLOGON task, a user process writing a service, or a newly replayed cloud session granting offline_access.
Hunting should also compare the artifact with an approved baseline. Attackers often choose names that resemble update agents or collaboration tools, so the name alone is weak. Creator process, signer, path, owner, trigger, scopes, and first-seen time establish meaning.
Deleting a scheduled task while leaving its payload creates a loose end. Deleting a payload while leaving its trigger creates recurring errors and hides whether another copy exists. Both sides need removal, followed by a new search for sibling mechanisms.
For cloud identity persistence, pair credential restoration with session revocation, refresh-token invalidation, malicious grant removal, inbox-rule review, and application credential rotation where applicable.
| FoylGuard EDR | Inspect scheduled tasks, Run keys, services, payloads, and creator lineage. |
| Identity | Review session, token, app-consent, and risky sign-in evidence. |
| Process Tree Hunt | Separate initial execution from the mechanism that survives it. |
| Account Takeover Response | Remove both cloud and endpoint persistence in SILENT DELEGATE. |