Research

Guided lab: the persistence that leaves almost no log

WMI event subscriptions run code on a condition you choose, survive reboots, live nowhere in the filesystem, and log nothing by default. The last of the persistence series, and the one that changes how you think about the other three.

Full write-up available to members subscribers. See what is included.

Guided lab: a service that starts before you do

Windows services run as SYSTEM and start before anyone logs in, which makes them the most valuable persistence on the box and the hardest to spot among the two hundred already there. Part three of the persistence series.