Persistence, Tactic TA0003 - Enterprise | MITRE ATT&CK®

Persistence consists of techniques that adversaries use to keep access to systems across restarts, changed credentials, and other interruptions that could cut off their access. Techniques used for persistence include any access, action, or configuration changes that let them maintain their foothold on systems, such as replacing or hijacking legitimate code or adding startup code.

Persistence, Tactic TA0003 - Enterprise | MITRE ATT&CK® ATT&CKcon 7.0 is coming October 27-28, 2026. Learn more about ATT&CKcon 7.0 . Home Tactics Enterprise Persistence Persistence The adversary is trying to maintain their foothold. Persistence consists of techniques that adversaries use to keep access to systems across restarts, changed credentials, and other interruptions that could cut off their access. Techniques used for persistence include any access, action, or configuration changes that let them maintain their foothold on systems, such as replacing or hijacking legitimate code or

related reading

• Valid Accounts, Technique T1078 - Enterprise | MITRE ATT&CK®attack.mitre.org
• Account Manipulation, Technique T1098 - Enterprise | MITRE ATT&CK®attack.mitre.org
• Initial Access, Tactic TA0001 - Enterprise | MITRE ATT&CK®attack.mitre.org
• External Remote Services, Technique T1133 - Enterprise | MITRE ATT&CK®attack.mitre.org
• Assessing Claude Mythos Preview’s cybersecurity capabilities \ Anthropicred.anthropic.com
• Operating Systems: Three Easy Piecespages.cs.wisc.edu
• Remote Services, Technique T1021 - Enterprise | MITRE ATT&CK®attack.mitre.org
• D3FEND Matrix | MITRE D3FEND™d3fend.mitre.org
• Anomalies detected by the Microsoft Sentinel machine learning engine | Microsoft Learnlearn.microsoft.com
• PerfectData Software Abuse and Account Takeover Risksdarktrace.com
• 什麼是 APT 攻擊/進階持續性威脅 (Advanced Persistent Threat, APT)？ - 資安趨勢部落格blog.trendmicro.com.tw
• Legacy authentication: The curious case of BAV2ROPCredcanary.com