Skip to main content

PERSISTENCE

note
  • The 262 - [💾Persistence] Filesystem Persistence (Win/Linux) collector will also provide the base64 encoded content of any files less than or equal to 1mb in size
  • The 262 - [💾Persistence] Registry Persistence (Win) collector has the advantage of loading user specific hives (UsrClass.dat and NTUSER.dat) for all users of the system for enumeration – HKCU keys will translate to a search against all user hives

This job template is designed to retrieve dynamic information from a system that can change rapidly in relation to other artifacts. This collection is more-so suited for baselining across multiple systems or searching through data for quick and easy-to-find IOCs.

Job Metadata
NamePERSISTENCE-TEMPLATE
Plugin Selection
📷 CollectorsCustom Plugins:
  • 262 - [💾Persistence] BITS Jobs (Win)
  • 262 - [💾Persistence] COM Objects (Win)
  • 262 - [💾Persistence] Drivers (Win/Linux)
  • 262 - [💾Persistence] Filesystem Persistence (Win/Linux)
  • 262 - [💾Persistence] Registry Persistence (Win)
  • 262 - [💾Persistence] Scheduled Tasks/CRON Jobs (Win/Linux)
  • 262 - [💾Persistence] Services (Win/Linux)
  • 262 - [💾Persistence] Shortcuts (Win)
  • 262 - [💾Persistence] Startup Commands (Win)
  • 262 - [💾Persistence] User Accounts (Win/Linux)
  • 262 - [💾Persistence] WMI Subscriptions (Win)
Built-in Plugins:
  • Accounts Collector
  • Autoruns Collector
  • KernelModules Collector
⛙ Transports
  • WMI Transport (if Windows targets + credentials available)
  • SMB Transport (if Windows targets + credentials available)
  • SSH Transport (if *Nix targets + credentials available)
🔍 Analyzers
  • Elasticsearch Analyzer
Configuration Options
⛭ PickupMaximum Pickup File Size
job.pickup.maxsize		1 Gigabyte
Maximum Timeout
job.pickup.timeout		10 Minutes