Analyse · MITRE ATT&CK
Persistence and evasion
How an intruder keeps access to a system that has already been compromised and tries to slip past security controls, what traces it leaves behind, and how defenders can detect and prevent it.
Why defenders study these techniques
An intruder rarely gets everything they want on first access. To stay in the system after a reboot or a password change, they use persistence techniques; to avoid being noticed by antivirus, EDR and analysts, they use evasion techniques. These are the phases in which an attack can go on for weeks without anyone noticing.
Knowing them tells you where to look: every persistence mechanism leaves a trace (a registry key, a service, a scheduled task) and every evasion attempt produces signals that good monitoring can pick up. The sooner you find the persistence, the shorter the intruder’s dwell time and the smaller the damage.
The cards describe what each technique does and how to recognise it, not how to carry it out. Use this knowledge only on systems you own or for which you have written authorisation: read Ethics and law before experimenting in a lab.
Technique cards
No technique matches your search or the selected filter.
How to read the ratings
Each technique has three ratings on a low / medium / high scale. They are qualitative estimates for teaching purposes, not measurements: in your environment they may differ considerably depending on the logs you collect and the tools you have. The colour shows who has the advantage: green favours the defender, red the attacker.
- Stealth
- How discreet the technique is. High: it leaves few traces visible to a routine check. Low: looking in the right place is enough to spot it.
- Prevalence
- How often the technique appears in incidents and public threat intelligence reports. High: it is among the first things to check.
- Detection difficulty
- How hard it is to notice. Low: a dedicated log event or a tool such as Autoruns is enough. High: you need advanced telemetry (EDR, a well-tuned Sysmon configuration) or memory analysis.
A technique with high prevalence and low detection difficulty is the first check to automate; one with high detection difficulty calls for investment in telemetry and analysis skills.
Quick comparison
| Technique | Stealth | Prevalence | Detection difficulty | Key countermeasure |
|---|
Further reading
Malware catalogue — documented families with indicators and countermeasures
Malware taxonomy — malware categories explained with examples
File analysis — static indicators of a suspicious file
Historic breaches — real cases and what they taught us
Ethics and law — what you may do, where and with what authorisation