Windows Persistence Techniques

You have SYSTEM or Administrator access on a Windows host during an authorized penetration test. Reason through persistence options.

**Registry-Based Persistence**
- What are the most commonly used registry Run keys and who does each affect?
- What is the difference between HKCU Run and HKLM Run from an attacker's perspective?
- What do Image File Execution Options (IFEO) enable and how are they abused?
- What is the Winlogon Userinit and Shell registry value and how is it abused?

**Scheduled Tasks**
- How do you create a scheduled task that runs at login vs at system boot?
- What task trigger types are least monitored by defenders?
- How does a COM hijack through scheduled tasks work?

**Service Persistence**
- How do you create a Windows service for persistence?
- What is the difference in stealth between a new service and modifying an existing service's binary path?
- Which built-in services are commonly abused for binary path modification?

**Startup Locations**
- What are all the startup folder locations per-user and system-wide?
- How does the Startup folder differ between Windows 10 and Windows Server environments?

**Advanced Techniques**
- What is a DLL side-loading and how is it used for persistence?
- What are Boot or Logon Autostart Execution locations beyond the obvious ones? (AppInit_DLLs, LSA notification packages, WinSock)
- What is COMhijacking and why is it harder to detect?

Output:
- Registry run key list with persistence type and detection risk
- Scheduled task creation command with minimal detection footprint
- Detection opportunities per technique