Windows persistence mechanisms

Try it out loud first. Then check yourself:

1. Registry Run/RunOnce keys under HKCU/HKLM Software\Microsoft\Windows\CurrentVersion are the classic choice
2. Scheduled tasks (Event 4698) and new services (System Event 7045) survive reboots and can run as SYSTEM
3. WMI event subscriptions (filter + consumer binding) are fileless and often missed by basic tooling
4. Other options: startup folder, DLL search-order hijacking, COM hijacking, Winlogon Shell/Userinit values
5. Hunt with Sysinternals Autoruns, Sysmon events 12/13 (registry) and 19-21 (WMI), and baseline diffs

If the interviewer pushes back

• Which persistence mechanisms survive a password reset and a reimage of the user profile but not a full rebuild?

Go deeper

• attack.mitre.org/tactics/TA0003/
• attack.mitre.org/techniques/T1547/001/
• attack.mitre.org/techniques/T1053/005/