Analytics Story: Windows Persistence Techniques

Updated Date: 2026-05-13 ID: 30874d4f-20a1-488f-85ec-5d52ef74e3f9 Author: Bhavin Patel, Splunk Product: Splunk Enterprise Security

Description

Monitor for activities and techniques associated with maintaining persistence on a Windows system--a sign that an adversary may have compromised your environment.

Why it matters

Maintaining persistence is one of the first steps taken by attackers after the initial compromise. Attackers leverage various custom and built-in tools to ensure survivability and persistent access within a compromised enterprise. This Analytic Story provides searches to help you identify various behaviors used by attackers to maintain persistent access to a Windows environment.

Detections

Name ▲▼	Technique ▲▼	Type ▲▼
Schedule Task with Rundll32 Command Trigger	Scheduled Task/Job	TTP
Certutil exe certificate extraction	Steal or Forge Authentication Certificates	TTP
Python PYTHONPATH Modification During Package Installation	Compromise Software Supply Chain, Path Interception by PATH Environment Variable	TTP
Screensaver Event Trigger Execution	Screensaver	TTP
Windows Mshta Execution In Registry	Mshta	TTP
Windows Scheduled Task Service Spawned Shell	Scheduled Task, Command and Scripting Interpreter	TTP
Windows Get-Variable.EXE Execution from WindowsApps Folder	Path Interception by Search Order Hijacking	Anomaly
Windows Scheduled Task with Suspicious Command	Scheduled Task	TTP
Registry Keys for Creating SHIM Databases	Application Shimming	TTP
Shim Database Installation With Suspicious Parameters	Application Shimming	TTP
Shim Database File Creation	Application Shimming	TTP
Python Site Hooks Creation During Package Installation	Compromise Software Supply Chain, Event Triggered Execution	TTP
Windows AppCertDLL Modification Via Registry	AppCert DLLs	Anomaly
Windows AppCertDLL Modification Via Command Line	AppCert DLLs	Anomaly
Monitor Registry Keys for Print Monitors	Port Monitors	TTP
Python PTH File Creation During Package Installation	Compromise Software Supply Chain, Event Triggered Execution	Anomaly
Scheduled Task Deleted Or Created via CMD	Scheduled Task	Anomaly
Windows Scheduled Task with Suspicious Name	Scheduled Task	TTP
Registry Keys Used For Persistence	Registry Run Keys / Startup Folder	TTP
Windows Scheduled Task Created in a Group Policy Object	Scheduled Task, Group Policy Modification	TTP
Hiding Files And Directories With Attrib exe	Windows Permissions	TTP
Windows AD DSRM Account Changes	Account Manipulation	TTP
Windows Compatibility Telemetry Suspicious Child Process	Scheduled Task, Event Triggered Execution	TTP
Windows Compatibility Telemetry Tampering Through Registry	Scheduled Task, Event Triggered Execution	TTP
WinEvent Scheduled Task Created to Spawn Shell	Scheduled Task	TTP
Windows New Default File Association Value Set	Change Default File Association	Hunting
Windows AD Same Domain SID History Addition	SID-History Injection	TTP
Windows Suspicious Defender Update Activity in INetCache	Exploitation for Privilege Escalation, Ingress Tool Transfer	Anomaly
Schedule Task with HTTP Command Arguments	Scheduled Task/Job	TTP
Detect Path Interception By Creation Of program exe	Path Interception by Unquoted Path	TTP
Windows Set Custom DNS ServerLevelPlugin Via Dnscmd	Hijack Execution Flow	Anomaly
Windows PowerShell Module File Created	PowerShell, Shared Modules, Hijack Execution Flow	Anomaly
Suspicious Scheduled Task from Public Directory	Scheduled Task	Anomaly
Schtasks used for forcing a reboot	Scheduled Task	TTP
Windows SymbolicLink-Testing-Tools Utility Execution	File and Directory Permissions Modification, NTFS File Attributes	TTP
Windows Schtasks Create Run As System	Scheduled Task	TTP
Print Processor Registry Autostart	Print Processors	TTP
Reg exe Manipulating Windows Services Registry Keys	Services Registry Permissions Weakness	TTP
ETW Registry Disabled	Trusted Developer Utilities Proxy Execution, Disable or Modify Tools	TTP
WinEvent Scheduled Task Created Within Public Path	Scheduled Task	TTP
Time Provider Persistence Registry	Time Providers	TTP
Windows Event Triggered Image File Execution Options Injection	Image File Execution Options Injection	Hunting
Active Setup Registry Autostart	Active Setup	TTP
Windows Registry Delete Task SD	Scheduled Task, Disable or Modify Tools	Anomaly
Logon Script Event Trigger Execution	Logon Script (Windows)	TTP
WinEvent Windows Task Scheduler Event Action Started	Scheduled Task	Hunting
Windows Service Creation Using Registry Entry	Services Registry Permissions Weakness	Anomaly
Windows Downdate Registry Activity	Modify Registry, Downgrade Attack	Anomaly
Windows Mock Trusted Directory MSC File Creation	MMC, Bypass User Account Control, Hijack Execution Flow	TTP
Windows Guest Account Enabled Via Net.EXE	Default Accounts	Anomaly

Data Sources

Name ▲▼	Platform ▲▼	Sourcetype ▲▼	Source ▲▼
Windows Event Log Security 4698	Windows	`XmlWinEventLog`	`XmlWinEventLog:Security`
Windows Event Log Security 4688	Windows	`XmlWinEventLog`	`XmlWinEventLog:Security`
Sysmon EventID 1	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
CrowdStrike ProcessRollup2	Other	`crowdstrike:events:sensor`	`crowdstrike`
Sysmon EventID 13	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
Windows Event Log Security 4702	Windows	`XmlWinEventLog`	`XmlWinEventLog:Security`
Windows Event Log Security 4700	Windows	`XmlWinEventLog`	`XmlWinEventLog:Security`
Sysmon EventID 11	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
Windows Event Log Security 5145	Windows	`XmlWinEventLog`	`XmlWinEventLog:Security`
Windows Event Log Security 4738	Windows	`XmlWinEventLog`	`XmlWinEventLog:Security`
Windows Event Log Security 4742	Windows	`XmlWinEventLog`	`XmlWinEventLog:Security`
Sysmon EventID 23	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
Windows Event Log Application 3000	Windows	`XmlWinEventLog`	`XmlWinEventLog:Application`
Sysmon EventID 12	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
Windows Event Log TaskScheduler 200	Windows	`wineventlog`	`WinEventLog:Microsoft-Windows-TaskScheduler/Operational`
Windows Event Log TaskScheduler 201	Windows	`XmlWinEventLog`	`XmlWinEventLog:Security`
Sysmon EventID 14	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`

References

Source: GitHub | Version: 3