persistence-info.github.io

View on GitHub

Windows Terminal Profile

Location:

%LOCALAPPDATA%\Packages\Microsoft.WindowsTerminal_8wekyb3d8bbwe\LocalState\settings.json

Classification:

Criteria Value
Permissions User
Security context User
Persistence type File
Code type EXE
Launch type User initiated1
Impact Non-destructive
OS Version All OS versions
Dependencies Additional software required2
Toolset Scriptable

Description:

  1. Modify the settings.json located in %localappdata% and add a custom profile that contains your payload
  2. Change the defaultProfile value and put your GUID
  3. Add the value "startOnUserLogin": true

References:

https://twitter.com/nas_bench/status/1550836225652686848

Credits:

@nas_bench

See also:

Remarks:

  1. Windows Terminal must be run 

  2. Windows Terminal required