persistence — tactic tag

Meaning and evidence boundary

Navigation membership is based on explicit metadata in this pinned module, not a claim of detection effectiveness or live validation.

Related pages

• T0859 Valid Accounts · simulation
• T0873 Project File Infection · simulation
• T0873.001 Siemens Project File Format · simulation
• T0889 Modify Program · simulation
• T1037 Boot or Logon Initialization Scripts · simulation
• T1037.001 Logon Script (Windows) · simulation
• T1037.002 Login Hook · simulation
• T1037.003 Network Logon Script · simulation
• T1037.004 RC Scripts · simulation
• T1037.005 Startup Items · simulation
• T1053 Scheduled Task/Job · simulation
• T1053.002 At · simulation
• T1053.003 Cron · simulation
• T1053.005 Scheduled Task · simulation
• T1053.006 Systemd Timers · simulation
• T1053.007 Container Orchestration Job · simulation
• T1078 Valid Accounts · simulation
• T1078.001 Default Accounts · simulation
• T1078.002 Domain Accounts · simulation
• T1078.003 Local Accounts · simulation
• T1078.004 Cloud Accounts · simulation
• T1098 Account Manipulation · simulation
• T1098.001 Additional Cloud Credentials · simulation
• T1098.002 Additional Email Delegate Permissions · simulation
• T1098.003 Additional Cloud Roles · simulation
• T1098.004 SSH Authorized Keys · simulation
• T1098.005 Device Registration · simulation
• T1098.006 Additional Container Cluster Roles · simulation
• T1098.007 Additional Local or Domain Groups · simulation
• T1112 Modify Registry · simulation
• T1133 External Remote Services · simulation
• T1136 Create Account · simulation
• T1136.001 Local Account · simulation
• T1136.002 Domain Account · simulation
• T1136.003 Cloud Account · simulation
• T1137 Office Application Startup · simulation
• T1137.001 Office Template Macros · simulation
• T1137.002 Office Test · simulation
• T1137.003 Outlook Forms · simulation
• T1137.004 Outlook Home Page · simulation
• T1137.005 Outlook Rules · simulation
• T1137.006 Add-ins · simulation
• T1176 Software Extensions · simulation
• T1176.001 Browser Extensions · simulation
• T1176.002 IDE Extensions · simulation
• T1197 BITS Jobs · simulation
• T1205 Traffic Signaling · simulation
• T1205.001 Port Knocking · simulation
• T1205.002 Socket Filters · simulation
• T1398 Boot or Logon Initialization Scripts · simulation
• T1505 Server Software Component · simulation
• T1505.001 SQL Stored Procedures · simulation
• T1505.002 Transport Agent · simulation
• T1505.003 Web Shell · simulation
• T1505.004 IIS Components · simulation
• T1505.005 Terminal Services DLL · simulation
• T1505.006 vSphere Installation Bundles · simulation
• T1525 Implant Internal Image · simulation
• T1541 Foreground Persistence · simulation
• T1542 Pre-OS Boot · simulation
• T1542.001 System Firmware · simulation
• T1542.002 Component Firmware · simulation
• T1542.003 Bootkit · simulation
• T1542.004 ROMMONkit · simulation
• T1542.005 TFTP Boot · simulation
• T1543 Create or Modify System Process · simulation
• T1543.001 Launch Agent · simulation
• T1543.002 Systemd Service · simulation
• T1543.003 Windows Service · simulation
• T1543.004 Launch Daemon · simulation
• T1543.005 Container Service · simulation
• T1546 Event Triggered Execution · simulation
• T1546.001 Change Default File Association · simulation
• T1546.002 Screensaver · simulation
• T1546.003 Windows Management Instrumentation Event Subscription · simulation
• T1546.004 Unix Shell Configuration Modification · simulation
• T1546.005 Trap · simulation
• T1546.006 LC_LOAD_DYLIB Addition · simulation
• T1546.007 Netsh Helper DLL · simulation
• T1546.008 Accessibility Features · simulation
• T1546.009 AppCert DLLs · simulation
• T1546.010 AppInit DLLs · simulation
• T1546.011 Application Shimming · simulation
• T1546.012 Image File Execution Options Injection · simulation
• T1546.013 PowerShell Profile · simulation
• T1546.014 Emond · simulation
• T1546.015 Component Object Model Hijacking · simulation
• T1546.016 Installer Packages · simulation
• T1546.017 Udev Rules · simulation
• T1546.018 Python Startup Hooks · simulation
• T1547 Boot or Logon Autostart Execution · simulation
• T1547.001 Registry Run Keys / Startup Folder · simulation
• T1547.002 Authentication Package · simulation
• T1547.003 Time Providers · simulation
• T1547.004 Winlogon Helper DLL · simulation
• T1547.005 Security Support Provider · simulation
• T1547.006 Kernel Modules and Extensions · simulation
• T1547.007 Re-opened Applications · simulation
• T1547.008 LSASS Driver · simulation
• T1547.009 Shortcut Modification · simulation
• T1547.010 Port Monitors · simulation
• T1547.012 Print Processors · simulation
• T1547.013 XDG Autostart Entries · simulation
• T1547.014 Active Setup · simulation
• T1547.015 Login Items · simulation
• T1554 Compromise Host Software Binary · simulation
• T1556 Modify Authentication Process · simulation
• T1556.001 Domain Controller Authentication · simulation
• T1556.002 Password Filter DLL · simulation
• T1556.003 Pluggable Authentication Modules · simulation
• T1556.004 Network Device Authentication · simulation
• T1556.005 Reversible Encryption · simulation
• T1556.006 Multi-Factor Authentication · simulation
• T1556.007 Hybrid Identity · simulation
• T1556.008 Network Provider DLL · simulation
• T1556.009 Conditional Access Policies · simulation
• T1577 Compromise Application Executable · simulation
• T1603 Scheduled Task/Job · simulation
• T1624 Event Triggered Execution · simulation
• T1624.001 Broadcast Receivers · simulation
• T1625 Hijack Execution Flow · simulation
• T1625.001 System Runtime API Hijacking · simulation
• T1645 Compromise Client Software Binary · simulation
• T1653 Power Settings · simulation
• T1668 Exclusive Control · simulation
• T1671 Cloud Application Integration · simulation
• T1676 Linked Devices · simulation
• T1693 Modify Firmware · simulation
• T1693.001 System Firmware · simulation
• T1693.002 Module Firmware · simulation
• T1694 Insecure Credentials · simulation
• T1694.001 Default Credentials · simulation
• T1694.002 Hardcoded Credentials · simulation