Hands-On Red Team Tactics

Installation

Once the malware is executed on the system, the first thing it needs to do is install itself (backdoor) on the system so that the adversaries can access it anytime they want to hide in such a way that the AVs don't detect its presence. Persistence can be achieved either by writing on the disk (this may include the startup folder, the registry, and so on) or in-memory/file-less write (such as WMI).