Malware Development for Ethical Hackers - Second Edition

3

Windows Malware Persistence Mechanisms

Access is fragile; if it cannot survive a reboot, it's of no use, but persistence is what keeps you in the system. In this chapter, we shift our focus to persistence: the methods used to ensure our presence remain constant on the target system. We will cover the implementation of standard techniques like Registry Run keys, Screensaver mechanism, and services, as well as advanced triggers like leveraging Winlogon process, DLL Hijacking, and non-trivial tricks. You will learn to build functional persistence modules and test them. We conclude with a look at stealth strategies used to bypass monitoring in high-security networks.

In this chapter, we're going to cover the following main topics:

• User-level persistence ...