Windows Red Team Persistence Techniques - Red Team Series

This course demonstrates Windows red-team persistence techniques using Empire, including registry keys, scheduled tasks, WMI, local user accounts, and PowerBreach backdoors. It assumes an existing foothold and C2 setup, then tests persistent agent connections after a system restart.

Syllabus

Introduction
What We’ll Be Covering
What is Persistence?
Mitre Attack Techniques - Persistence
Empire Persistence Modules
Let’s Get Started
Recap of Some Starkiller Features
Renaming Agents
Unprivileged vs Privileged Agents
Creating a an Additional Privileged Agent
Beginning our Persistence Techniques
Using the Registry-Key Persistence Module
Using the Scheduled Tasks Persistence Module
Using the WMI Persistence Module
Using Local User Accounts as a Means of Persistence
Using the PowerBreach Module to create a Backdoor
Checking if our Agents are Pinging Back
Conclusion