Persistence Labs
How attackers survive a reboot on Windows, and the exact artifacts each persistence mechanism leaves behind.
- Triage a Suspected-Compromised Windows 11 PC in 30 Minutes
A fast, ordered pass over a Windows 11 machine you think is compromised, using only free tools. What to check, in what sequence, and how to tell a real finding from normal noise.
Attack and detection · Beginner · T1057, T1543
- Event IDs 7045 and 4698: Spotting Persistence on Windows 11
A new service and a new scheduled task are the two most common ways malware survives a reboot on Windows. Both are logged. Here is how to read those events and separate them from normal software installs.
Attack and detection · Intermediate · T1543.003, T1053.005
- Scheduled Task Persistence on Windows 11: The Attack and Its Artifacts
How a persistent scheduled task is planted on Windows 11, demonstrated in an isolated lab, and the exact registry keys, XML files, and event IDs it leaves behind for a defender to find.
Attack and detection · Intermediate · T1053.005