Windows Local Privilege Escalation via CdpSvc service (Writeable SYSTEM path Dll Hijacking)

Weaponizing for privileged file writes bugs with PrintNotify Service

Resources About Persistence, Multiple Platforms. Including ~80 Tools and 300+ Posts.

Adapt practically persistence steadiness strategies working at Windows 10 utilized by sponsored nation-state threat actors, as Turla, ProjectSauron, APT29, EquationGroup, including Stuxnet / Flame.

Wisper helps to maintain access to windows machine and have some other cool features like UAC Disable,Firewall Disable,Dumping Credentials,etc.

This guide empowers non-tech Windows users to detect persistence threats, highlighting signs like cmd windows at startup, registry checks, and spotting malicious commands in PowerShell, cmd, rundll32, and wmic.

RatInject: C++ tool for stealthy Windows persistence via registry-based techniques.

Linux-persistence shows how to join user/pid/net/mnt/ipc/uts/cgroup namespaces via /proc/*/ns/* and setns(), unshare with UID/GID mapping, daemonize, beacon over 127.0.0.1:8443, optional self-delete. 🐙

This case study analyzed a low-complexity but real-world-relevant example of attacker persistence using the built-in Windows utility schtasks.exe.

A lightweight red team beacon with COM-based persistence and HTTP-based exfiltration.