Hello and welcome
to another application of the minor
attack framework discussion
today we're getting into our next
phase and therefore we're going to
be discussing persistence.
And so no better time to look
at what is persistence.
So within minor persistence
is when a threat actor attempts to
maintain access to the environment,
also known as a foothold
threat. Actors commonly attempt to
maintain access after reboots
of systems, changes to
credentials, changes to the network.
And so this can include things like
the replacement of legitimate code
or adding items to start
up tasks. And so outside
of those things as well, this could
include the installation of remote
access tools or
other backdoor functions
on systems that
would hopefully not get caught in
the process of remediation
or something of that nature.
Now, within the persistance
section, we're going to be looking
at the following areas.
Now, there's more than
the few that we're mentioning here,
but these are the ones we've chosen
to focus on.
So we're going to look at accessibility
features and how those are used.
We're going to talk specifically
about Bukit browser
extensions, component firmware,
the creation of an account
hooking and new services.
Again, each of these areas is
probably compounded.
So it may not be just one of these
areas that a threat actor would
implement in order to
establish persistance.
It could be a combination of
creating a new account, creating
a boot kit, maybe implementing a new
service, adding
browser extensions, messing with
accessibility features.
It's quite possible and feasible
that a threat actor would have a
tool that would make multiple
changes so that if
one particular vector was cut off,
they would still have another that
they could use and maybe give a
false sense of security to
the end user.
So with that in mind, I want to
thank you for your time today, and
I look forward to seeing you again
soon.