Persistence

Offensive Security

DiskShadow on SecurityListing: A tool that exposes the functionality of the Volume Shadow Copy Service (VSS) for creation, enumeration, and manipulation of volume shadow copies, with features for persistence and evasion.

Offensive Security

Abusing the COM Registry Structure: CLSID, LocalServer32, & InprocServer32 on SecurityListing: Abusing the COM Registry Structure: CLSID, LocalServer32, & InprocServer32

Threat Hunting

Linux Detection Engineering - A primer on persistence mechanisms on SecurityListing: A comprehensive guide on Linux persistence mechanisms, focusing on scheduled tasks and jobs, their implementation, detection, and hunting strategies.

Offensive Security

Vshadow on SecurityListing: A command line utility for managing volume shadow copies with capabilities for evasion, persistence, and file extraction.