Often, adversaries want their malicious program to stay on the compromised computers, even when the Windows restarts. This is achieved using various persistence methods; this persistence allows an attacker to remain on the compromised system without having to re-infect it. There are many ways to run the malicious code each time Windows starts. In this section, you will understand some of the persistence methods used by the adversaries. Some of these persistence techniques covered in this section allow the attackers to execute malicious code with elevated privileges (privilege escalation).
One of the most common persistence mechanisms used by adversaries to survive the reboot is achieved by adding an entry to the run registry keys. The program that is added to the run registry key gets executed at system startup. The following is a list of the most common run registry keys. Malware can add itself to various auto-start locations in addition...