Simple definition
In cybersecurity, persistence means the mechanisms an attacker uses to retain or regain access after an interruption.
Purpose and use
It aims to survive events such as sign-out, reboot or an initial remediation action.
How does it work?
The mechanism may involve accounts, services, tasks or boot components. It varies with platform and obtained privileges.
Key points
- Example: unauthorized access returns after reboot because an automatic-start component was not identified.
- Reconstruct changes and verify access mechanisms across the affected scope after containment.
Points to watch
A service or scheduled task is often legitimate. Investigate ownership, creation and purpose before removal.
In short
Persistence maintains hostile access; removing it is part of incident eradication.