Home TacticsPersistence

ATT&CK Tactics

Tactics represent the "why" of an ATT&CK technique. They are the adversary's tactical goals: the reason for performing an action. There are 14 tactics in the Enterprise ATT&CK Matrix.

TA0043

TA0003

Persistence

The adversary is trying to maintain their foothold. Persistence consists of techniques that adversaries use to keep access to systems across restarts, changed credentials, and other interruptions.

Associated Techniques(18)

T1098

Account Manipulation

Adversaries may manipulate accounts to maintain access to victim systems.

7 sub-techniques

T1197

BITS Jobs

Adversaries may abuse BITS jobs to persistently execute code and perform various background tasks.

T1547

Boot or Logon Autostart Execution

Adversaries may configure system settings to automatically execute a program during system boot or logon.

14 sub-techniques

T1037

Boot or Logon Initialization Scripts

Adversaries may use scripts automatically executed at boot or logon initialization.

5 sub-techniques

T1136

Create Account

Adversaries may create an account to maintain access to victim systems.

3 sub-techniques

T1543

Create or Modify System Process

Adversaries may create or modify system-level processes to repeatedly execute malicious payloads.

5 sub-techniques

T1546

Event Triggered Execution

Adversaries may establish persistence using system mechanisms that trigger execution based on specific events.

18 sub-techniques

T1574

Hijack Execution Flow

Adversaries may execute their own malicious payloads by hijacking the way operating systems run programs.

12 sub-techniques

T1556

Modify Authentication Process

Adversaries may modify authentication mechanisms to access user credentials or enable otherwise unwarranted access.

9 sub-techniques

T1505

Server Software Component

Adversaries may abuse legitimate extensible development features of servers to establish persistent access.

6 sub-techniques

T1205

Traffic Signaling

Adversaries may use traffic signaling to hide open ports or other malicious functionality.

2 sub-techniques

T1137

Office Application Startup

Adversaries may leverage Microsoft Office-based applications for persistence between startups.

6 sub-techniques

T1176

Browser Extensions

Adversaries may abuse Internet browser extensions to establish persistent access to victim systems.

T1525

Implant Internal Image

Adversaries may implant cloud or container images with malicious code to establish persistence.

T1542

Pre-OS Boot

Adversaries may abuse Pre-OS Boot mechanisms as a way to establish persistence on a system.

5 sub-techniques

T1053

Scheduled Task/Job

Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code.

5 sub-techniques

T1078

Valid Accounts

Adversaries may obtain and abuse credentials of existing accounts as a means of gaining persistence.

4 sub-techniques

T1554

Compromise Host Software Binary

Adversaries may modify host software binaries to establish persistent access to systems.

CIC-ATT&CK

ATT&CK Tactics

Recon

Resource Dev

Initial Access

Execution

Persistence

Priv Esc

Defense Evasion

Cred Access

Discovery

Lateral Move

Collection

C2

Exfiltration

Impact

Persistence

Associated Techniques(18)

Account Manipulation

BITS Jobs

Boot or Logon Autostart Execution

Boot or Logon Initialization Scripts

Create Account

Create or Modify System Process

Event Triggered Execution

Hijack Execution Flow

Modify Authentication Process

Server Software Component

Traffic Signaling

Office Application Startup

Browser Extensions

Implant Internal Image

Pre-OS Boot

Scheduled Task/Job

Valid Accounts

Compromise Host Software Binary