Persistence

1. Monitor Registry for changes to run keys that do not correlate with known software, patch cycles, etc.

2. Monitor the start folder for additions or changes

SELECT UNIQUE Command, Location

• Mitre Registry Run Keys / Start Folder