Persistence - Windows

  1. T1547: Boot or Logon Autostart Execution

  2. T1546: Event Triggered Execution

  3. T1053: Scheduled Task/Job

  4. T1176: Browser Extensions

  5. T1183: Image File Execution Options Injection

  6. T1543: Create or Modify System Process

  7. T1133: External Remote Services

  8. T1136: Create Account

  9. T1556: Modify Authentication Process

  10. T1108: Redundant Access

  11. T1505: Server Software Component

  12. T1037: Boot or Logon Initialization Scripts

  13. T1078: Valid Accounts

PreviousExecution - WindowsNextPrivilege Escalation - Windows

Last updated