Initial access is often only the first stage of an intrusion. After gaining execution on a server or endpoint, an attacker may attempt to create a mechanism that survives reboots, reconnects later, or provides continued access.
The source defines a cross-platform persistence hunt covering common Windows and Linux mechanisms.
Windows Persistence Mechanisms
The Windows portion monitors execution of:
schtasks.exe;sc.exe;reg.exe;wmic.exe.
It then looks for command-line patterns related to task creation, registry additions, execution, service ImagePath changes, or RunOnce activity.
File-Based Persistence Monitoring
The second part uses file integrity monitoring to identify changes under:
/etc/cron.d/;/var/spool/cron/;SSH
authorized_keys;Windows Startup;
System32\Tasks.
Detection Query
(data.win.system.eventID:1 and data.win.eventdata.image:(*\schtasks.exe or *\sc.exe or *\reg.exe or *\wmic.exe) and data.win.eventdata.commandLine:(*create* or *add* or *run* or *ImagePath* or *RunOnce*)) or (rule.groups: syscheck and syscheck.event: (added or modified) and syscheck.path:(*/etc/cron.d/* or */var/spool/cron/* or */.ssh/authorized_keys or *\Start*Menu\Programs\Startup\* or *\System32\Tasks\*))
The source recorded 509 results during the previous 30 days.
Why Persistence Is Difficult to Detect
Every mechanism in the query also has legitimate administrative uses. Scheduled tasks run backups and maintenance. Services are created by software installations. Cron jobs support Linux operations. SSH authorized keys may be part of normal access management.
The security value comes from identifying unexpected changes rather than treating the mechanism itself as malicious.
Investigation Workflow
For each match, review:
creating process;
user or service account;
exact command line;
target task, service, registry value, cron file, or SSH key;
timestamp relative to other suspicious activity;
host role;
whether the persistence object actually executed later.
Persistence created immediately after an RCE or suspicious shell event should receive higher priority.
Tuning the Rule
Create a baseline of known scheduled tasks, services, cron jobs, and administrative keys.
Then focus on:
new names;
unusual executable paths;
user-writable directories;
encoded or obfuscated commands;
rare accounts;
execution outside change windows.
Avoid excluding an entire mechanism globally.
Correlation Opportunities
This hunt can be combined with other detections in the source, including:
web-server shell execution;
defense evasion;
reverse shells;
credential dumping;
ransomware staging.
A sequence of initial execution followed by persistence provides a much stronger incident narrative.
Operational Value
Persistence hunting is useful because it can expose attacker activity even after the original exploit event has passed.
By monitoring both command-based and file-based persistence mechanisms, defenders can identify attempts to turn temporary access into durable control.
