Technique Library

MITRE ATT&CK-based attack techniques — Exploit · Prevention · Detection

6 techniques · Persistence

T1546.003PersistenceAdvanced

Windows Management Instrumentation (WMI) event subscription writes the __EventFilter (WQL trigger), __EventConsumer (command/script payload), and __FilterToConsumerBinding triplet persistently into the root\\subscription CIM repository, providing a backdoor that runs with SYSTEM privileges and leaves no traditional autorun trace on disk. For detection, Sysmon EID 19/20/21 and WMI-Activity EID 5861 form the primary signature layer; process tree anomaly and subscription hunting form the behavioral layer.

June 13, 202637 min read

Exploit

Prevention

Detection

T1098PersistenceExpert

When dangerous rights on DACLs attached to every Active Directory object (GenericAll, WriteDACL, WriteOwner, AllExtendedRights, ForceChangePassword, AddMember) are exploited, an attacker can trigger chains of password resets, group additions, targeted Kerberoasting, shadow credential injection, and DCSync permission grants with just a few LDAP operations. A single ACE added to the AdminSDHolder object propagates to all protected objects in a 60-minute cycle via the SDProp mechanism, creating a self-repairing backdoor. Detection relies on attribute-level behavioral monitoring on Events 5136/4662/4670; prevention relies on least privilege, tiered architecture, and periodic BloodHound ACL auditing.

June 13, 202643 min read

Exploit

Prevention

Detection

T1053.005PersistenceAdvanced

Windows Task Scheduler (schtasks.exe / Schedule.Service COM) is widely used by attackers for both persistence and remote execution (lateral movement). This article covers schtasks syntax, XML task structure, TaskCache registry, EID 4698/4699/4700/4701/4702 + TaskScheduler/Operational 106/140/141/200/201 telemetry, Sigma rules, and hardening controls.

June 13, 202610 min read

Exploit

Prevention

Detection

T1543.003PersistenceAdvanced

A comprehensive map of the Windows Service Control Manager (SCM) attack surface: new service creation (T1543.003), ServiceDll hijack, unquoted path / weak binary and registry ACL exploitation (T1574.009-011), PsExec-style transient service for lateral movement (T1569.002). EID 7045/4697, Sysmon EID 13 detection, and Sigma correlations for SOC and red/purple teams.

June 13, 202612 min read

Exploit

Prevention

Detection

T1543.002PersistenceAdvanced

For SOC and IR teams operating in Linux environments: persistence mechanisms (cron/systemd/shell startup files/SSH authorized_keys/LD_PRELOAD/kernel module), privilege escalation paths (SUID/SGID, sudo misconfiguration, capabilities), and the forensic analysis methodology that surfaces them — auditd ruleset, auth.log/journald queries, /proc live response, and hardening controls.

June 13, 202619 min read

Exploit

Prevention

Detection

T1574.001PersistenceAdvanced

A comprehensive map of how attackers abuse Windows DLL loading mechanisms: DLL search order hijacking (T1574.001), side-loading (T1574.002), phantom DLL, COM hijacking (T1546.015, InprocServer32/HKCU), AppInit_DLLs (T1546.010), AppCert DLLs (T1546.009), Netsh helper DLL (T1546.007), and Application Shimming (T1546.011). KnownDLLs and WinSxS protection mechanisms, Sysmon EID 7 (ImageLoad)-based detection, and SafeDllSearchMode hardening guide.

June 13, 202616 min read

Exploit

Prevention

Detection