MITRE ATT&CKtactic
TA0003 Persistence
- Domain
- enterprise
- Version
- 1.0
- Created
- 2018-10-17
Description
The adversary is trying to maintain their foothold.
Persistence consists of techniques that adversaries use to keep access to systems across restarts, changed credentials, and other interruptions that could cut off their access. Techniques used for persistence include any access, action, or configuration changes that let them maintain their foothold on systems, such as replacing or hijacking legitimate code or adding startup code.
Related
Referenced by MITRE ATT&CK · tactic (113)
- T1546.018 Python Startup Hooks sub-technique
- T1176.001 Browser Extensions sub-technique
- T1176.002 IDE Extensions sub-technique
- T1505.006 vSphere Installation Bundles sub-technique
- T1671 Cloud Application Integration technique
- T1668 Exclusive Control technique
- T1546.017 Udev Rules sub-technique
- T1098.007 Additional Local or Domain Groups sub-technique
- T1543.005 Container Service sub-technique
- T1556.009 Conditional Access Policies sub-technique
- T1098.006 Additional Container Cluster Roles sub-technique
- T1653 Power Settings technique
- T1556.008 Network Provider DLL sub-technique
- T1205.002 Socket Filters sub-technique
- T1556.007 Hybrid Identity sub-technique
- T1546.016 Installer Packages sub-technique
- T1556.006 Multi-Factor Authentication sub-technique
- T1505.005 Terminal Services DLL sub-technique
- T1098.005 Device Registration sub-technique
- T1556.005 Reversible Encryption sub-technique
- T1547.015 Login Items sub-technique
- T1505.004 IIS Components sub-technique
- T1053.007 Container Orchestration Job sub-technique
- T1547.014 Active Setup sub-technique
- T1542.004 ROMMONkit sub-technique
- T1542.005 TFTP Boot sub-technique
- T1556.004 Network Device Authentication sub-technique
- T1053.006 Systemd Timers sub-technique
- T1547.012 Print Processors sub-technique
- T1205.001 Port Knocking sub-technique