TA0003 Persistence Mappings

The adversary is trying to maintain their foothold. Persistence consists of techniques that adversaries use to keep access to systems across restarts, changed credentials, and other interruptions that could cut off their access. Techniques used for persistence include any access, action, or configuration changes that let them maintain their foothold on systems, such as replacing or hijacking legitimate code or adding startup code.

View in MITRE ATT&CK®

ATT&CK Techniques

Technique ID Technique Name Number of Mappings Number of Subtechniques
T1098 Account Manipulation 12 4
T1197 BITS Jobs 14 0
T1037 Boot or Logon Initialization Scripts 9 5
T1176 Browser Extensions 15 0
T1554 Compromise Client Software Binary 9 0
T1136 Create Account 15 3
T1543 Create or Modify System Process 21 4
T1546 Event Triggered Execution 4 10
T1133 External Remote Services 18 0
T1574 Hijack Execution Flow 19 11
T1525 Implant Internal Image 16 0
T1556 Modify Authentication Process 16 4
T1137 Office Application Startup 13 6
T1542 Pre-OS Boot 19 4
T1053 Scheduled Task/Job 15 6
T1505 Server Software Component 23 4
T1205 Traffic Signaling 9 1
T1078 Valid Accounts 23 4