// MITRE ATT&CK
🎯 Persistence TA0003
MITRE ATT&CK techniques under the Persistence tactic (64). Each explains the "how" the adversary pursues in this phase.
T1037
Boot or Logon Initialization Scripts T1543
Create or Modify System Process T1133
External Remote Services T1547
Boot or Logon Autostart Execution T1547.014
Active Setup T1176.001
Browser Extensions T1543.003
Windows Service T1137
Office Application Startup T1098.003
Additional Cloud Roles T1547.012
Print Processors T1137.006
Add-ins T1505.002
Transport Agent T1098.006
Additional Container Cluster Roles T1505.005
Terminal Services DLL T1176
Software Extensions T1137.005
Outlook Rules T1098.007
Additional Local or Domain Groups T1547.010
Port Monitors T1037.002
Login Hook T1547.009
Shortcut Modification T1525
Implant Internal Image T1547.005
Security Support Provider T1543.004
Launch Daemon T1505.003
Web Shell T1547.003
Time Providers T1136.001
Local Account T1176.002
IDE Extensions T1547.004
Winlogon Helper DLL T1098.004
SSH Authorized Keys T1136.002
Domain Account T1137.001
Office Template Macros T1098.005
Device Registration T1547.015
Login Items T1098.001
Additional Cloud Credentials T1554
Compromise Host Software Binary T1547.001
Registry Run Keys / Startup Folder T1136.003
Cloud Account T1098
Account Manipulation T1547.006
Kernel Modules and Extensions T1137.003
Outlook Forms T1543.005
Container Service T1505.004
IIS Components T1547.002
Authentication Package T1137.004
Outlook Home Page T1037.005
Startup Items T1671
Cloud Application Integration T1546.018
Python Startup Hooks T1037.003
Network Logon Script T1543.001
Launch Agent T1505
Server Software Component T1037.004
RC Scripts T1543.002
Systemd Service T1668
Exclusive Control T1136
Create Account T1547.013
XDG Autostart Entries T1547.007
Re-opened Applications T1098.002
Additional Email Delegate Permissions T1653
Power Settings T1037.001
Logon Script (Windows) T1137.002
Office Test T1547.008
LSASS Driver T1546.017
Udev Rules T1505.006
vSphere Installation Bundles T1505.001
SQL Stored Procedures
Boot or Logon Initialization Scripts T1543
Create or Modify System Process T1133
External Remote Services T1547
Boot or Logon Autostart Execution T1547.014
Active Setup T1176.001
Browser Extensions T1543.003
Windows Service T1137
Office Application Startup T1098.003
Additional Cloud Roles T1547.012
Print Processors T1137.006
Add-ins T1505.002
Transport Agent T1098.006
Additional Container Cluster Roles T1505.005
Terminal Services DLL T1176
Software Extensions T1137.005
Outlook Rules T1098.007
Additional Local or Domain Groups T1547.010
Port Monitors T1037.002
Login Hook T1547.009
Shortcut Modification T1525
Implant Internal Image T1547.005
Security Support Provider T1543.004
Launch Daemon T1505.003
Web Shell T1547.003
Time Providers T1136.001
Local Account T1176.002
IDE Extensions T1547.004
Winlogon Helper DLL T1098.004
SSH Authorized Keys T1136.002
Domain Account T1137.001
Office Template Macros T1098.005
Device Registration T1547.015
Login Items T1098.001
Additional Cloud Credentials T1554
Compromise Host Software Binary T1547.001
Registry Run Keys / Startup Folder T1136.003
Cloud Account T1098
Account Manipulation T1547.006
Kernel Modules and Extensions T1137.003
Outlook Forms T1543.005
Container Service T1505.004
IIS Components T1547.002
Authentication Package T1137.004
Outlook Home Page T1037.005
Startup Items T1671
Cloud Application Integration T1546.018
Python Startup Hooks T1037.003
Network Logon Script T1543.001
Launch Agent T1505
Server Software Component T1037.004
RC Scripts T1543.002
Systemd Service T1668
Exclusive Control T1136
Create Account T1547.013
XDG Autostart Entries T1547.007
Re-opened Applications T1098.002
Additional Email Delegate Permissions T1653
Power Settings T1037.001
Logon Script (Windows) T1137.002
Office Test T1547.008
LSASS Driver T1546.017
Udev Rules T1505.006
vSphere Installation Bundles T1505.001
SQL Stored Procedures
Source: MITRE ATT&CK®. ATT&CK is a registered trademark of The MITRE Corporation. Content for educational purposes.