{"id":1025,"date":"2022-08-03T15:00:00","date_gmt":"2022-08-03T14:00:00","guid":{"rendered":"https:\/\/conscia.com\/ie\/?p=1025"},"modified":"2025-09-23T15:04:04","modified_gmt":"2025-09-23T14:04:04","slug":"diving-deep-how-to-detect-malware-persistency-pt-1","status":"publish","type":"post","link":"https:\/\/conscia.com\/ie\/blog\/diving-deep-how-to-detect-malware-persistency-pt-1\/","title":{"rendered":"Diving Deep: How to detect Malware Persistency pt. 1"},"content":{"rendered":"\n

During a cyber-attack adversaries might gain access to an environment through a certain system, but that might not be their actual targeted system or that might not be their end goal. To establish a permanent foothold<\/strong> in the environment and plan new attacks within the environment or simply continue to infect the system through reboots, adversaries need to establish persistency in that environment. There are several ways to do that and, in this article series, we will list some of the most prevalent malware persistency mechanisms.<\/p>\n\n\n\n

In this entry, we will focus on utilizing\u00a0Windows registry for malware persistency<\/strong>.<\/p>\n\n\n\n

Windows Registry<\/h2>\n\n\n\n

Windows registry is utilized by the system to store and retrieve system and user settings. However, malware authors can exploit this utility to ensure persistency for the malicious software by inserting values into registries that are automatically executed on startup<\/strong>.<\/p>\n\n\n\n

Here are some typical locations for autoruns:<\/p>\n\n\n\n