Course 16 - Red Team Ethical Hacking Beginner Course | Episode 6: Windows Persistence Strategies: Registry, Scheduled Tasks, Services, WMI | CyberCode Academy

In this lesson, you’ll learn about:

The purpose of persistence in red team operations
Common local Windows persistence mechanisms and how they function
Event-driven persistence using WMI
The difference between host-level and domain-level persistence
Why Kerberos Golden Tickets represent a critical enterprise risk

Overview This lesson provides a comprehensive technical explanation of Windows persistence strategies, focusing on how attackers maintain long-term access after an initial compromise. Persistence is a post-exploitation objective that ensures access survives:

System reboots
User logouts
Password changes
Partial remediation efforts

All techniques discussed are framed within authorized red team engagements, defensive awareness training, and detection engineering contexts. 1. Local System Persistence Techniques Local persistence mechanisms ensure continued execution of malicious code on a single compromised host. 1.1 Registry Run Keys Concept Windows supports registry keys that automatically launch applications when users log in. How It Works

A startup entry is added to a global registry location
The payload executes whenever any user logs in
The method survives reboots and user changes

Why It’s Effective

Simple and reliable
Commonly abused by malware
Often overlooked during basic incident response

Defensive Insight Security teams should monitor:

Startup registry locations
Unsigned or unusual binaries referenced by run keys

1.2 Scheduled Tasks Concept Scheduled Tasks allow programs to execute automatically based on time or system conditions. How It Works

A background task is created to run repeatedly
Execution can be time-based or event-based
The task operates independently of user interaction

Why It’s Effective

Blends in with legitimate administrative activity
Can execute frequently to re-establish access
Flexible timing and execution context

Defensive Insight Blue teams should audit:

Newly created or modified tasks
Tasks executing from unusual directories

1.3 Windows Services (SCM) Concept Windows services start automatically when the system boots and typically run with elevated privileges. How It Works

A service is configured to launch at startup
Execution occurs before user login
Often runs with SYSTEM-level permissions

Why It’s Effective

Highly persistent
Very powerful privilege context
Survives reboots consistently

Defensive Insight Detection should focus on:

New or modified services
Services running unsigned or unexpected executables

1.4 WMI Event Subscriptions (Advanced Persistence) Concept Windows Management Instrumentation (WMI) supports event-driven automation, which can be abused for stealthy persistence. Architecture WMI persistence consists of three logical components:

Event Filter – Watches for a specific system condition
Consumer – Defines the action to perform
Binding – Connects the event to the action

Why It’s Effective

No visible startup entries
No scheduled tasks or services
Triggers only when specific events occur

Defensive Insight This is one of the hardest techniques to detect. Monitoring requires:

WMI repository inspection
Event subscription auditing
Behavioral correlation

2. Domain-Level Persistence: Golden Tickets Concept Golden Tickets exploit Kerberos authentication to provide permanent domain-wide access. How It Works (High-Level)

The Kerberos service account secret is compromised
A forged authentication ticket is created
The ticket grants Domain Admin privileges to any chosen identity

Why This Is Critical

Access persists even if:
- Passwords are reset
- Accounts are disabled
- Administrators are removed
The attacker can generate new valid credentials at will

Impact This technique effectively gives an attacker:

Unlimited access to the domain
Full control over users, systems, and policies
A near-undetectable persistence mechanism if not monitored

Defensive Insight Mitigation requires:

Rotating Kerberos service secrets
Monitoring authentication anomalies
Implementing strong domain hygiene and detection tooling

Host vs Domain Persistence ComparisonPersistence TypeScopeRisk LevelRegistry / TasksSingle HostMediumServicesSingle HostHighWMI SubscriptionsSingle HostHigh (Stealthy)Golden TicketsEntire DomainCritical

Why Persistence Matters in Red Teaming Persistence is not about destruction—it’s about testing resilience. Professional red teams use persistence to:

Measure detection and response maturity
Test cleanup effectiveness
Identify gaps in monitoring
Improve blue team readiness

Every persistence mechanism must also include a clean removal path. Conceptual Analogy Think of persistence as hiding spare access keys:

Registry & Services → A key hidden where you check every day
Scheduled Tasks → A door that unlocks automatically on a timer
WMI Subscriptions → A smart sensor that opens the door only under specific conditions
Golden Tickets → Access to the locksmith’s master system that can mint new keys on demand

Some keys affect one door. Others open the entire city. Key Educational Takeaways

Persistence is a post-exploitation objective, not an exploit
Simpler methods are more common, advanced methods are stealthier
Domain-level persistence is exponentially more dangerous
Detection is possible—but requires deep visibility
Ethical red team operations prioritize documentation and cleanup

You can listen and download our episodes for free on more than 10 different platforms:
https://linktr.ee/cybercode_academy

Course 16 - Red Team Ethical Hacking Beginner Course | Episode 6: Windows Persistence Strategies: Registry, Scheduled Tasks, Services, WMI

About this episode

Get every episode summarized

More from CyberCode Academy

Course 42 - Mobile Malware Analysis Fundamentals | Episode 13: Designing and Arc...

Course 42 - Mobile Malware Analysis Fundamentals | Episode 12: Dynamic Analysis...

Course 42 - Mobile Malware Analysis Fundamentals | Episode 11: Dynamic Analysis...

Course 42 - Mobile Malware Analysis Fundamentals | Episode 10: The Essentials of...