RED TEAM Operator: Windows Persistence Course

Intro and Setup

Introduction to Windows Persistence

5 mins

Intro Addendum

8 mins

Course VM Setup

3 mins

RTO-PERS.ova

RTO-pers.zip

220 KB

Low Privilege Persistence

Start Folder and Registry Keys

7 mins

Logon Scripts

4 mins

Shortcut Mods

7 mins

Screensavers

5 mins

Powershell Profile

4 mins

DLL Proxying - Introduction

4 mins

DLL Proxying - Demo

24 mins

Component Object Model - Introduction

9 mins

COMs Registry

4 mins

COM Hijacks and Proxies

16 mins

Admin Level Persistence

Elevated Scheduled Tasks

10 mins

Multiaction Tasks

7 mins

New & Modified Services

10 mins

IFEO - Debugger / SilentProcessExit / Verifier

19 mins

Application Shims

9 mins

Windows Management Instrumentation - Introduction

3 mins

WMI Event Subscription

7 mins

AppCert DLLs

10 mins

AppInit DLLs

8 mins

Netsh Helper DLLs

6 mins

Winlogon - SHELL / USERINIT

7 mins

Time Providers

10 mins

Port Monitors

9 mins

Local Security Authority - Introduction

5 mins

LSA-as-a-Persistence - SSPs & AuthPkgs

10 mins

LSA-as-a-Persistence - Password Filters

6 mins

Assignments

Assignment #1

Assignment #2

Assignment #3

Assignment #4

Wrap up

Summary and Next Steps

5 mins

Table of contents

Low Privilege Persistence

Admin Level Persistence