Persistence
In intrusion operations, persistence is the set of mechanisms an attacker plants so their access survives reboots, credential changes and clean-up. It is the difference between an intrusion that ends when a machine is restarted and one that has to be hunted, and it is what a red team exercise is meant to test the response to.
How it works
Anything the operating system runs automatically is a candidate, and a mechanism that also bypasses authentication is additionally a backdoor. Scheduled tasks and services. Registry run keys and startup locations. Shell profile scripts and cron entries on Unix systems. Modules loaded by a legitimate application. A library placed where a signed executable will load it. Group policy and configuration management, which are attractive because they redeploy the mechanism to every host after each clean-up.
The strongest forms are not files at all. A credential taken during the intrusion works after every reboot without anything being installed. A certificate enrolled for a privileged identity survives a password reset. A refresh token or an application consent in a cloud tenant keeps working while attention is on the servers. Those are the ones that survive an eradication built around endpoints.
What goes wrong
Eradication scoped to malware misses all of the identity mechanisms. The team rebuilds the affected machines and does not reset the service account whose password was recovered, does not revoke the tokens, does not remove the mail rule and does not revoke the certificate. The intruder returns and the second incident is reported as a new one.
The second failure is expecting persistence to look unusual. A scheduled task with a plausible name running a signed system utility looks like administration, which is exactly why living off the land and persistence are usually the same conversation. Baseline knowledge is what separates them, and most estates have no baseline of what is supposed to run at startup.
The third is assuming there is one. A competent operator installs several by different mechanisms, deliberately including one that is easy to find, so that discovering it feels like resolution. Removing the obvious one and stopping is the outcome that mechanism was designed to produce.
Where this shows up in an audit
We install multiple mechanisms during an exercise, document each one with its exact location, and after the client declares the environment clean we attempt to return. Whether we come back, and through which mechanism, is the most useful single result an exercise produces, because it tests eradication rather than detection. The full inventory is handed over and removal is verified jointly, which feeds directly into incident response improvement. This is part of how we test whether an intruder can be removed.