Feel free to contribute!
As you can see, I have just started, and there are hundreds of persistence mechanisms to cover.
Your effort will be appreciated, and is never too small to be helpful :)
If need some tips how to contribute, here you have it:
Definitions:
- Persistence mechanism - configuration change, making the arbitrary code to run automatically, or in a way making it likely to happen unexpectedly due to typical user actions such as right-click on files etc.
- Configuration change - change of a file content, registry settings, database data, etc.
- Scope - Windows systems currently supported or popular. Exceptions may happen if the mechanism relies on very common non-OS dependencies such as Microsoft Office, Google Chrome etc.
- Exclusions - replacement of a binary file with another binary file may count as a persistence mechanism, but will be not reflected in the repository as possibilities are endless and not really interesting.
- Entries are defined by the configuration change LOCATION, not the configuration change itself. Two very different entries within the Run registry key count as one persistence mechanism.
Classification:
- Permissions
- User (👨💼) - standard user permissions are good enough to create the persistence
- Admin - standard user permissions are NOT good enough to create the persistence
- Security context
- User - code runs as the user being logged-on within the user session
- System - code runs as the localsystem
- Other - code runs in the security context not described above
- Persistence type
- Files only - it is enough to drop a file to make code run
- Registry - reasonably simple registry changes are required to make code run
- Other - something more than registry and files is required
- Code type
- EXE - EXE file is executed as a new process
- DLL - DLL is loaded by a processes (not being result of any persistence mechanism) in a way making code run.
- Other - scripts etc.
- Fileless - no new files are put on disk to create a persistence mechanisms
- Launch type
- Automatic (⚙) - it is enough to start windows to make code run
- Any logon required - any user must log on to make code run
- Same logon required - same user must log on to make code run
- User initiated - user must log on and perform some actions to make code run
- Other - other scenarios
- Impact
- Destructive - typical OS functionalities are negatively affected by creating a persistence mechanism
- Non-destructive - typical OS functionalities are NOT negatively affected by creating a persistence mechanism
- OS version
- All OS versions - it is enough to have any current Windows version
- Windows Server - Windows Server required
- Other - all other cases
- Dependencies
- OS Only - standard OS installation is enough to make persistence happen
- Additional components required - some unusual Windows components are required, such as server roles, non-standard features etc
- Additional software required - non-OS software components are required to make persistence method work
- Toolset
- Scriptable - built-in OS tools and zero clicking is enough to create a persistence
- PowerShell - built-in OS tools are not enough but PowerShell can do the job and the script exists
- Non-scriptable - built-in OS tools only, but some clicking is required to create a persistence
- Own toolkit required - anything else