Anthropic-Cybersecurity-Skills/skills/hunting-for-persistence-mechanisms-in-windows/references/standards.md

Standards and References - Windows Persistence Hunting

MITRE ATT&CK Persistence Techniques (TA0003)

Boot or Logon Autostart Execution (T1547)

Sub-Technique	Name	Registry/Location
T1547.001	Registry Run Keys / Startup Folder	HKLM/HKCU Run, RunOnce, Startup
T1547.002	Authentication Package	HKLM\SYSTEM\CurrentControlSet\Control\Lsa
T1547.003	Time Providers	HKLM\System\CurrentControlSet\Services\W32Time\TimeProviders
T1547.004	Winlogon Helper DLL	HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon
T1547.005	Security Support Provider	HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Security Packages
T1547.006	Kernel Modules and Extensions	Driver loading
T1547.009	Shortcut Modification	.lnk files in Startup
T1547.010	Port Monitors	HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors
T1547.012	Print Processors	HKLM\SYSTEM\CurrentControlSet\Control\Print\Environments
T1547.014	Active Setup	HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components
T1547.015	Login Items	(macOS)

Create or Modify System Process (T1543)

Sub-Technique	Name
T1543.003	Windows Service
T1543.004	Launch Daemon (macOS/Linux)

Scheduled Task/Job (T1053)

Sub-Technique	Name
T1053.005	Scheduled Task
T1053.003	Cron
T1053.002	At

Event Triggered Execution (T1546)

Sub-Technique	Name
T1546.001	Change Default File Association
T1546.002	Screensaver
T1546.003	WMI Event Subscription
T1546.004	Unix Shell Configuration Modification
T1546.007	Netsh Helper DLL
T1546.008	Accessibility Features (sethc, utilman, narrator)
T1546.010	AppInit DLLs
T1546.011	Application Shimming
T1546.012	Image File Execution Options Injection
T1546.013	PowerShell Profile
T1546.015	COM Hijacking
T1546.016	Installer Packages

Hijack Execution Flow (T1574)

Sub-Technique	Name
T1574.001	DLL Search Order Hijacking
T1574.002	DLL Side-Loading
T1574.006	Dynamic Linker Hijacking
T1574.008	Path Interception by Search Order Hijacking
T1574.009	Path Interception by Unquoted Service Path
T1574.011	Services Registry Permissions Weakness
T1574.012	COR_PROFILER

Key Registry Persistence Locations

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify
HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\BootExecute
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit
HKLM\SOFTWARE\Classes\CLSID\{GUID}\InprocServer32
HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Security Packages
HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Authentication Packages
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Custom
HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components

Detection Event IDs

Source	Event ID	Meaning
Sysmon	12	Registry object created/deleted
Sysmon	13	Registry value set
Sysmon	14	Registry object renamed
Sysmon	19	WMI EventFilter created
Sysmon	20	WMI EventConsumer created
Sysmon	21	WMI ConsumerToFilter binding
Windows Security	4697	Service installed
Windows Security	4698	Scheduled task created
Windows Security	4699	Scheduled task deleted
Windows Security	7045	New service installed
Task Scheduler	106	Task registered
Task Scheduler	140	Task updated