Executive TL;DR
- Advanced threat actors often establish persistence mechanisms early in an intrusion to maintain long-term access, even after remediation activities begin.
- Many organizations successfully remove visible indicators of compromise while leaving underlying access paths intact across identity systems, cloud environments, and trusted infrastructure.
- Persistence increasingly survives patching, endpoint cleanup, and password resets because attackers abuse legitimate tools, inherited trust relationships, and hybrid identity complexity.
- Modern persistence is no longer limited to malware. Identity abuse, OAuth application compromise, cloud IAM manipulation, and living-off-the-land techniques now play a central role in long-term attacker access.
- Red teaming and adversary simulation help organizations validate whether attacker persistence truly survived remediation efforts before threat actors exploit those gaps again.
The Gap Between Cleanup and Eviction
While most organisations focus on how attackers get in, mature attackers focus on how they stay. In many incidents, the visible compromise is only the beginning of a longer and far quieter operation.
The malware is removed. Systems are patched. Passwords are reset. Operations resume. But advanced threat actors rarely depend on a single access point.
Modern attackers increasingly establish persistence mechanisms designed specifically to survive remediation efforts, allowing them to quietly maintain or regain access without needing to exploit the environment again. In many cases, organizations unknowingly remove symptoms while leaving the underlying access paths untouched.
This shift has become increasingly visible across modern incident response investigations, where the challenge is often no longer identifying the initial compromise, but fully eliminating the attacker’s ability to return. Recent findings highlighted in Google Cloud’s M-Trends 2026 Executive Edition continue showing that modern intrusions are increasingly defined not only by how attackers gain access, but by how effectively they maintain operational access after detection and containment efforts begin.
This creates one of the most dangerous gaps in modern cybersecurity operations: false remediation confidence.
The long-term recovery challenges following the SolarWinds compromise demonstrated how difficult attacker eviction becomes once access extends beyond compromised endpoints and into interconnected trust layers across identity, cloud, and administrative infrastructure.
Modern persistence no longer relies solely on malware implants. Advanced threat actors increasingly maintain long-term access through federated identity relationships, delegated permissions, OAuth applications, trusted tooling, and cloud-integrated authentication paths that many organizations struggle to fully map or validate.
For enterprise leadership, the key question is no longer simply:
“Was the incident resolved?”
It is rather:
“Did we actually fully eliminate attacker access?”
Field Example: When Cleanup Did Not Remove Access
That distinction increasingly defines the difference between short-term recovery and long-term exposure.
During an offensive security engagement for a new customer, our company observed how attacker persistence can survive incident response. While performing penetration testing against a production web application, our team identified a vulnerability that could provide access to the underlying system. During exploitation, we discovered unusual file artifacts and reported them to the customer for further investigation.
With our support, the customer later confirmed that the files were remnants of a previous intrusion. Although incident response had already been conducted, and the customer believed the threat actor had been removed, the remaining artifacts showed that access had not been fully eliminated.
This case illustrates a difficult reality: incident response is not only about removing visible indicators. It is also about validating that attackers no longer have a way to maintain or regain access after the initial compromise.
Table of Contents
- The False Sense of Remediation
- Where Persistence Actually Lives
- Why Organizations Fail to Remove Persistence
- Real-World Persistence Techniques Used by Advanced Threat Actors
- How Red Teaming Exposes Persistence Failures
- Operational Takeaways
- FAQ
The False Sense of Remediation
Many remediation efforts focus heavily on restoring operational stability as quickly as possible. Once the immediate threat appears contained, organizations often shift attention toward recovery and business continuity.
The problem is that advanced threat actors frequently plan persistence from the beginning of an intrusion.
Modern attackers assume their initial access vector may eventually be discovered. As a result, they often establish multiple fallback mechanisms across identity infrastructure, cloud services, administrative tooling, and trusted systems early in the attack lifecycle.
This means the removal of visible malware or the patching of an exploited vulnerability does not necessarily eliminate attacker access.
When Cleanup Does Not Remove Access
An organisation may:
- Patch the vulnerable VPN appliance
- Remove malicious files
- Reset compromised user passwords
- Restore affected systems
…while attackers still maintain persistence through:
- OAuth application abuse
- Cloud IAM manipulation
- Service account compromise
- Forged Kerberos tickets
- Hidden privileged accounts
- Trusted remote management tooling
Attackers do not need to break in twice if they never fully lost access.
This is one of the reasons why post-remediation compromise continues to appear in modern incident response investigations. In many cases, the original intrusion vector was closed successfully, but secondary persistence mechanisms remained operational.
The business implications are significant. Persistence that survives remediation can lead to prolonged attacker dwell time, repeated operational disruption, reinfection risk, and false confidence in incident resolution.
What Red Teams Often Find
During Red Team operations, we often observe security teams focusing first on removing visible implants or exploitation artifacts, such as webshells. However, identity- and cloud-based persistence can be overlooked, especially when remediation efforts are focused on restoring systems quickly.
For example, we frequently find privileged accounts with passwords configured to never expire. Over time, these accounts may retain old or weak credentials. If such an account is compromised during a Red Team exercise, it can provide a path for long-term access within the network.
If the Red Team temporarily loses its foothold and later regains access, for example, through a successful social engineering attack, that previously compromised privileged account could be reused immediately. This illustrates one of the core risks of incomplete incident response: visible artifacts may be removed while durable access paths remain available.
Where Persistence Actually Lives
Persistence is no longer confined to infected endpoints.
Today, advanced threat actors increasingly maintain access inside the systems organizations trust the most.
Endpoints and Operating System Persistence
Traditional persistence mechanisms remain effective in enterprise environments.
Threat actors commonly abuse:
- Scheduled Tasks
- Windows Services
- Registry Run Keys
- Startup folders
- WMI event subscriptions
These techniques are documented in the MITRE ATT&CK framework and continue to appear in real-world intrusions because they are reliable, flexible, and difficult to distinguish from legitimate administrative activity.
However, sophisticated attackers rarely rely on endpoint persistence alone.
Identity Systems and Active Directory
Identity infrastructure has become one of the most critical persistence layers in modern enterprise environments.
Attackers increasingly focus on:
- privileged account abuse
- delegated permissions
- service accounts
- trust relationships
- Kerberos manipulation
- hybrid identity synchronization
Golden Ticket and Silver Ticket attacks remain particularly dangerous because they exploit trust within Active Directory itself. Once attackers compromise Kerberos signing material, they may continue generating forged authentication tickets even after passwords are changed.
Identity persistence often survives remediation because organizations underestimate how interconnected identity trust relationships have become across hybrid environments.
Attackers increasingly persist through authentication, not malware.
Cloud and SaaS Persistence
Cloud adoption has significantly expanded persistence opportunities.
Modern enterprise environments now contain:
- cloud IAM policies
- OAuth integrations
- API trust relationships
- SaaS platforms
- service principals
- federated identity systems
This creates persistence opportunities that traditional endpoint-focused remediation workflows may entirely miss.
Common examples include:
- malicious OAuth applications
- abused refresh tokens
- compromised service principals
- long-lived API keys
- IAM privilege escalation
- persistence through delegated cloud permissions
OAuth abuse is especially concerning because attackers may retain access to email, collaboration platforms, or cloud storage even after user passwords are reset.
Advisories from CISA and researchers continue emphasizing cloud identity persistence as a growing operational risk.
Living-Off-the-Land Techniques
Many advanced threat actors avoid deploying obvious malware whenever possible.
Instead, they abuse legitimate native tools already trusted inside enterprise environments.
Common examples include:
- PowerShell
- WMIPsExec
- Remote administration tools
- Scripting engines
- LOLBins (Living-Off-the-Land Binaries)
For a deeper look at how these techniques operate in practice, see our analysis of living-off-the-land attacks.
These tools reduce detection opportunities because they are already used operationally by IT and administrative teams.
When Legitimate Access Becomes Persistent Access
During one Red Team operation, we identified a vulnerability that posed a serious risk to the target organization. A member of the organization’s IT team used an API to administer its Cisco-managed network infrastructure. To interact with the cloud-hosted management API, the employee had generated a privileged API credential that could remotely modify the network environment.
During the assessment, we were able to retrieve this credential because it had been stored insecurely. The credential did not expire automatically and had extensive privileges over the network infrastructure. As long as it remained valid and was not revoked, it could have provided a durable path for regaining privileged access.
Depending on the platform’s capabilities, this access could potentially have allowed changes to VPN settings, creating a new route into the internal network. Alternatively, changes to the wireless network configuration could have achieved a similar result.
The activity could have blended into normal administrative API usage because the requests would have been authenticated with a valid credential belonging to an authorized administrator. Detection would therefore have depended on whether the organization actively monitored API usage, credential activity, and network configuration changes.
This scenario shows how a poorly protected, highly privileged API credential can become both an initial access vector and a long-lived mechanism for regaining access to an environment.
Why Organisations Fail to Remove Persistence
Most organizations do not fail because they ignore remediation.
Industry research increasingly points to a widening gap between rapid detection capabilities and the slower, more complex process of fully restoring trust across compromised environments. SANS has highlighted how many organizations still struggle to transition effectively from incident containment into full operational recovery and validation.
They fail because modern persistence operates across systems that are difficult to fully map, monitor, and validate.
Patching Is Not Eradication
Organizations frequently focus remediation around the original exploit path.
However, once attackers establish persistence elsewhere, patching the initial vulnerability does not remove secondary access mechanisms.
A compromised edge appliance may be patched successfully while attackers still maintain:
- privileged cloud access
- forged authentication tickets
- delegated permissions
- OAuth persistence
- service account access
The vulnerability may be resolved. The access may not be.
Password Resets Alone Are Not Enough
Password resets remain an important containment measure, but they often fail to eliminate:
- OAuth refresh tokens
- Golden or Silver Tickets
- compromised API keys
- service principal abuse
- federated identity persistence
- hidden privileged accounts
In modern enterprise environments, one of the biggest remediation blind spots is the assumption that resetting credentials automatically restores trust across identity infrastructure, federated authentication systems, and privileged access relationships.
This becomes even more complex in hybrid environments where identity systems span:
- on-premises Active Directory
- Microsoft Entra ID
- SaaS platforms
- cloud infrastructure
- third-party integrations
Organizations frequently remediate one layer while leaving another exposed.
Visibility Gaps
Many organizations maintain strong endpoint visibility but lack equivalent monitoring across:
- cloud IAM changes
- OAuth activity
- service account behavior
- delegated permissions
- identity trust relationships
- cross-platform authentication flows
Threat actors intentionally exploit these gaps because persistence hidden inside trusted systems often generates minimal operational noise.
Inherited Trust Becomes an Attack Surface
Modern enterprise environments rely heavily on trust.
Systems trust:
- signed binaries
- federated identities
- privileged accounts
- service principals
- cloud integrations
- administrative tooling
Attackers abuse these trust relationships because trusted activity attracts less scrutiny.
Persistence survives because organizations often struggle to distinguish legitimate operational behavior from malicious persistence hidden inside trusted systems.
One example of identity-based persistence involves the abuse of Active Directory Certificate Services (AD CS). In recent years, AD CS has received increasing attention from the offensive-security community because misconfigured certificate services and templates can enable privilege escalation, lateral movement, and persistent access.
Enterprise AD CS deployments include built-in certificate templates for users and computers, some of which support authentication. Whether these templates present an exploitable path depends on several factors, including which templates the certification authority is configured to issue, who has enrollment permissions, the certificate’s intended uses, and how the certificate is mapped to an Active Directory account.
If an attacker obtains a valid authentication certificate and its associated private key, changing the compromised account’s password does not invalidate that certificate. As such, the certificate may therefore remain usable until it expires or is otherwise invalidated.
From an attacker’s perspective, this represents a significant advantage. In our experience, less-experienced Blue Teams may focus primarily on removing malware and other visible artifacts from compromised systems. During this process, they may overlook certificates issued to compromised identities or persistent changes made through those identities, such as modifications to Active Directory objects, permissions, or group memberships. If these elements are not identified and remediated, they may provide an attacker with a durable means of regaining access after the initial compromise has been contained.
Real-World Persistence Techniques Used by Advanced Threat Actors
Several persistence techniques continue appearing consistently across enterprise intrusions.
Scheduled Tasks and Services
Threat actors commonly establish recurring execution through:
- Scheduled Tasks
- malicious services
- automated startup processes
These techniques remain effective because they blend naturally into administrative operations and often survive reboots or maintenance cycles.
Registry Run Keys
Registry Run Keys allow malicious processes or scripts to execute automatically during startup or user login.
While well-known, these mechanisms continue succeeding because organizations sometimes prioritize malware cleanup without validating persistence artifacts afterward.
Account Manipulation
Account manipulation remains one of the most operationally dangerous forms of persistence.
Threat actors may:
- create secondary privileged accounts
- modify group memberships
- abuse dormant accounts
- assign delegated permissions
- compromise service accounts
Unlike malware-based persistence, identity-based persistence can survive endpoint replacement entirely.
Golden and Silver Tickets
Golden Ticket attacks allow attackers to forge Kerberos tickets after compromising the KRBTGT account hash within Active Directory environments.
Silver Tickets target specific service accounts instead.
These techniques are especially dangerous because they undermine trust inside the authentication infrastructure itself.
OAuth Application Abuse
OAuth abuse has become increasingly common in cloud-centric environments.
Attackers may:
- compromise legitimate OAuth applications
- trick users into granting malicious consent
- abuse refresh tokens
- maintain persistent access to SaaS platforms
Password resets alone often fail to eliminate this type of persistence.
WMI, PowerShell, and LOLBins
Living-off-the-land persistence remains highly effective because attackers leverage tools organizations already trust operationally.
PowerShell scripts, WMI subscriptions, and legitimate binaries frequently allow attackers to maintain access while blending into normal administrative activity.
One recurrent persistence opportunity that we encountered is tied to startup scripts. These Batch or PowerShell scripts are pushed via Group Policies (GPOs) and they are used by Active Directory administrators to push configurations to computers upon logon. It is not uncommon that those startup scripts can be modified, which provides an straight-forward persistence opportunity. An attacker could simply add some lines to the startup script to maintain persistence.
How Red Teaming Exposes Persistence Failures
One of the biggest challenges organizations face is validating whether attacker access was truly eliminated after remediation.
Traditional remediation workflows often confirm:
- systems were patched
- malware was removed
- credentials were reset
But they may not validate whether persistence mechanisms survived elsewhere in the environment.
This is where red teaming and adversary simulation provide significant operational value.
Rather than assuming remediation succeeded, offensive security assessments help organizations evaluate:
- whether hidden persistence paths still exist
- whether identity abuse remains possible
- whether cloud trust relationships can still be exploited
- whether attackers can quietly re-establish access
- whether detection teams identify persistence activity effectively
This shifts the conversation away from theoretical security posture and toward operational validation.
In many environments, offensive testing reveals:
- overlooked OAuth grants
- residual administrative privileges
- inherited IAM permissions
- unmanaged service accounts
- hidden trust relationships
- cloud persistence that survived endpoint remediation
Importantly, these gaps often exist even in organizations with mature security programs.
The most dangerous persistence mechanisms are often the ones organizations never validate.
As part of our Red Team operations, we assess the security of the target organization’s Active Directory environment. We frequently identify and report previously unknown relationships, permissions, and configuration weaknesses that could enable an attacker to escalate privileges to the domain level.
These escalation paths may remain unnoticed for years, particularly when they result from accumulated administrative changes, nested group memberships, delegated permissions, or legacy configurations. Their continued presence can therefore represent a significant security risk.
A Red Team exercise provides an opportunity to demonstrate the practical impact of such an escalation path in a controlled manner. Rather than simply highlighting an isolated vulnerability, the exercise shows how multiple overlooked relationships or weaknesses can be combined to compromise critical components. This helps the organization recognize and address risks that were not previously documented or fully understood.
Operational Takeaways
- Most organisations remove visible threats faster than they remove underlying attacker access.
- Persistence increasingly lives in identity systems, cloud environments, and trusted administrative tooling.
- Patching vulnerabilities does not necessarily eliminate persistence mechanisms established after compromise.
- Password resets alone frequently fail to invalidate modern identity-based persistence.
- Trusted systems and legitimate tools often become the most effective persistence layers for advanced threat actors.
- Organisations that validate remediation through adversary simulation are often better positioned to uncover hidden persistence before attackers reuse it.
Organisations that validate persistence assumptions through real-world adversary simulation are often better positioned to identify hidden access paths before threat actors exploit them again.
Learn how wizlynx group helps organisations assess real-world attacker persistence across identity, infrastructure, cloud, and hybrid enterprise environments.
Frequently Asked Questions
Can attackers maintain access after malware removal?
Yes. Advanced threat actors frequently establish persistence mechanisms that survive malware cleanup, including identity abuse, OAuth persistence, scheduled tasks, cloud IAM manipulation, and compromised service accounts.
Does patching a vulnerability remove attacker persistence?
Not necessarily. Patching may eliminate the original intrusion vector while leaving secondary persistence mechanisms operational elsewhere in the environment.
Why is identity persistence difficult to detect?
Identity-based persistence often abuses legitimate authentication systems, delegated permissions, trusted accounts, and cloud integrations that appear operationally normal.
Can password resets eliminate persistence?
Password resets remain important, but they may not invalidate OAuth tokens, forged Kerberos tickets, compromised API keys, or malicious cloud integrations.
Why are living-off-the-land techniques dangerous?
Living-off-the-land techniques abuse legitimate administrative tools already trusted within enterprise environments, making malicious activity harder to distinguish from normal operations.
How does red teaming help identify persistence gaps?
Red teaming helps organizations validate whether attackers could still maintain or regain access after remediation by simulating real-world adversary behavior across identity, infrastructure, and cloud environments.
This article was co-authored with Raphael Nägert, Senior Security Consultant and Red Teamer at wizlynx group. Raphael specializes in offensive security, supporting organizations through focused security assessments, such as web application testing, as well as broader end-to-end red team exercises. Their work applies an adversarial perspective to challenge assumptions, uncover vulnerabilities, and identify weaknesses across complex environments. Raphael has contributed to security assessments and adversary simulation engagements across multiple industries, including the financial sector and other highly sensitive environments.
wizlynx group is a CREST-accredited offensive security company headquartered in Switzerland, operating across Europe, North America, Latin America, and Asia. wizlynx group specializes in penetration testing, red teaming, adversary simulation, social engineering, and advanced security assessments for enterprise clients.