Tag Hunting for Persistence with Cympire

Threat Hunting

Hunting for Persistence with Cympire: Part IV — Startup Folder

Hunting for Persistence with Cympire - Startup Folder

Learn how attackers use the Windows Startup Folder to maintain persistence once they’ve compromised a machine. Then hunt for these malicious Startup Folder items.

Adam Goss
17 April 2023

Threat Hunting

Hunting for Persistence with Cympire: Part III — Services

Hunting for Persistence with Cympire - Service Persistence

Learn how attackers use Windows services to maintain persistence once they’ve compromised a machine. Then see how to hunt for these malicious services.

Adam Goss
3 April 2023

Threat Hunting

Hunting for Persistence with Cympire: Part II — Scheduled Tasks

Hunting for Persistence with Cympire - Scheduled Task Persistence

Learn how attackers use scheduled tasks to maintain persistence once they’ve compromised a machine. Then see how to hunt for these tasks.

Adam Goss
6 March 2023

Threat Hunting

Hunting for Persistence with Cympire: Part I — Registry Run Keys

Hunting for Persistence with Cympire - Registry Run Persistence

Learn how attackers use Windows registry keys to maintain persistence once they’ve compromised a machine. Then see how to hunt for these malicious keys.

Adam Goss
8 February 2023