What is MITRE ATT&CK Persistence (TA0003)?

The MITRE ATT&CK framework is a knowledge based designed to help understand the actions and steps cyber adversaries take to achieve their objectives. This allows cybersecurity professionals to stay apprised of the tactics that adversaries leverage to carry out the most effective defensive maneuvers to keep networks and infrastructure secure.

One tactic in this framework is Persistence. This tactic (TA0003) aims to ensure a continuous presence on a target system across restarts, changed credentials, and other interruptions. By establishing persistence, adversaries aim to maintain access for long periods, which can aid in achieving their objectives, such as data theft, espionage, or lateral movement.

What Techniques are Included in Persistence?

Account Manipulation (T1098)
1. Description: An adversary might change properties of user accounts, such as password or permissions, to ensure continuous access.
2. Examples:
  1. Modifying existing user account passwords.
    1. Assigning token privileges to an account for further activities.
  2. Mitigation: Monitor for and restrict unnecessary changes to user accounts. Implement multi-factor authentication.
3. Create Account (T1136)
  1. Description: Adversaries create new accounts (local, domain, or cloud) to maintain a presence within an environment.
  2. Examples:
    1. Creating a new local administrator.
    2. Establishing a new cloud service account for persistence
  3. Mitigation: Limit and monitor permissions for account creation. Regularly review and clean up stale accounts.
4. Scheduled Task/Job (T1053)
  1. Description: Adversaries can use task scheduling utilities to execute programs or scripts at system startup or on a scheduled basis for persistence.
  2. Examples:
    1. Utilizing Windows Task Scheduler to run a script every day.
    2. Leveraging cron jobs in Linux systems.
  3. Mitigation: Monitor and restrict changes to scheduled tasks or jobs, especially those that initiate on system startup or user login.
5. Boot or Logon Autostart Execution (T1547)
  1. Description: This technique encompasses several methods that automatically start a program or script when the system boots or a user logs in.
  2. Examples:
    1. Registry keys that automatically start programs during boot or logon.
    2. Scripts placed in the startup folder.
  3. Mitigation: Monitor common persistence locations like 'Run' registry keys and startup folders. Employ application whitelisting.
6. Hijack Execution Flow (T1574)
  1. Description: Adversaries redirect the execution path of software on the system to execute their code, often exploiting the way the system searches for associated files or libraries.
  2. Examples:
    1. DLL Search Order Hijacking: An adversary places a malicious DLL in a directory so it's loaded before the legitimate one.
    2. Pointer/System Call Table Hijacking: Modifying pointers in tables to redirect to malicious code.
  3. Mitigation: Employ application whitelisting and regularly scan systems for unexpected or altered binaries.
7. Event Triggered Execution (T1546)
  1. Description: The malicious code is triggered by specific events, such as a user logging in or a system status change.
  2. Examples:
    1. Windows Event Log entries that trigger scripts.
    2. Unix system logs that initiate a shell script.
  3. Mitigation: Monitor and restrict changes to event-based triggers and system logs.
8. Web Shell (T1505.003)
  1. Description: A web shell is a script placed on a web server that allows adversaries to execute arbitrary system commands. It's often placed on public-facing servers as a backdoor.
  2. Examples:
    1. A PHP-based web shell that permits command execution via a web form.
    2. ASP or JSP web shells embedded into web server directories.
  3. Mitigation: Regularly scan web servers for unexpected files and content changes. Employ a web application firewall (WAF).

Each technique, as mentioned earlier, has its nuances, specific methods of exploitation, mitigation measures, and detection methods. The above is a more detailed overview, but for a comprehensive understanding, the MITRE ATT&CK matrix and associated documentation should be referenced.

Why is it Important to Understand the Persistence Tactic?

The MITRE ATT&CK Persistence tactic is critically important for several reasons:

Long-Term Access: Persistence mechanisms allow adversaries to maintain access to a compromised system over extended periods, which can be vital for their operations. Whether the intent is espionage, data theft, or establishing a foothold for future attacks, ensuring that their access is not lost after the initial compromise is key.
Resilience to Disruptions: Systems undergo routine activities that can disrupt an attacker's presence, such as reboots, user logoffs, or system updates. By establishing persistence, adversaries can survive these disruptions and remain embedded in the system.
Facilitate Lateral Movement: Maintaining persistence can aid adversaries in moving laterally across a network. If one endpoint gets cleaned or isolated, having multiple points of persistence ensures they can continue their operations from another compromised system.
Complexity of Complete Remediation: Persistence techniques can be varied and numerous. When an organization discovers one compromised system or method of persistence, it doesn't guarantee they've found them all. This complexity makes the complete remediation of an incident challenging.
Stealth: Many persistence methods are designed to be stealthy and mimic legitimate system activities or processes, making them hard to detect. The longer an adversary can silently remain in a system, the more damage they can potentially cause.
Increase Attack ROI: From the adversary's perspective, establishing persistence increases the return on investment (ROI) for their initial effort of breaching a system. Once inside, if they can maintain access effortlessly through persistence mechanisms, it means their initial efforts continue to pay off without repeatedly breaking in.
Complicate Defense and Response: For defenders, detecting and eradicating every trace of an adversary from the network becomes a complex task. Every persistent method must be found and removed, and the more persistence mechanisms in place, the harder and more time-consuming this becomes.
Psychological Impact: Knowing that an adversary has established persistence can have a demoralizing effect on an organization. It creates a sense of continuous vulnerability and can strain trust in the IT infrastructure.

Given these reasons, understanding the Persistence tactic is crucial for both attackers and defenders. For attackers, it's a cornerstone of maintaining and furthering the attack, and for defenders, detecting and mitigating persistence is foundational in ensuring the integrity and security of their systems and networks.

How NETSCOUT Helps

NETSCOUT Omnis Cyber Intelligence (OCI) helps identify adversaries inside your network. For example, if an adversary abuses legitimate services to establish persistence, OCI can alert security teams of this threat.

NETSCOUT Omnis Network Security is an award-winning network detection and response (NDR) platform that is designed to keep the most complex networks safe and secure. Learn more about our packet-based cybersecurity solutions today.

What is MITRE ATT&CK Persistence?