Persistence, Tactic TA0003 - Enterprise | MITRE ATT&CK®

Persistence consists of techniques that adversaries use to keep access to systems across restarts, changed credentials, and other interruptions that could cut off their access. Techniques used for persistence include any access, action, or configuration changes that let them maintain their foothold on systems, such as replacing or hijacking legitimate code or adding startup code.

Persistence, Tactic TA0003 - Enterprise | MITRE ATT&CK® ATT&CKcon 7.0 is coming October 27-28, 2026. Learn more about ATT&CKcon 7.0 . Home Tactics Enterprise Persistence Persistence The adversary is trying to maintain their foothold. Persistence consists of techniques that adversaries use to keep access to systems across restarts, changed credentials, and other interruptions that could cut off their access. Techniques used for persistence include any access, action, or configuration changes that let them maintain their foothold on systems, such as replacing or hijacking legitimate code or

related reading

• Initial Access, Tactic TA0001 - Enterprise | MITRE ATT&CK®attack.mitre.org
• Valid Accounts, Technique T1078 - Enterprise | MITRE ATT&CK®attack.mitre.org
• Account Manipulation, Technique T1098 - Enterprise | MITRE ATT&CK®attack.mitre.org
• External Remote Services, Technique T1133 - Enterprise | MITRE ATT&CK®attack.mitre.org
• Trusted Relationship, Technique T1199 - Enterprise | MITRE ATT&CK®attack.mitre.org
• PerfectData Software Abuse and Account Takeover Risksdarktrace.com
• Responding to Adversary in the Middle attacksinvictus-ir.com
• D3FEND Matrix | MITRE D3FEND™d3fend.mitre.org
• Remote Services, Technique T1021 - Enterprise | MITRE ATT&CK®attack.mitre.org
• Threat actors misuse OAuth applications to automate financially driven attacksmicrosoft.com
• Cloud Email Security - Block Malicious Email Attacks | Abnormal AIabnormal.ai
• What Is Cyber Threat Hunting? Complete Guide | Exabeamexabeam.com