Evasion and Persistence Techniques
How an attacker avoids detection and keeps access
Once inside a compromised network, an advanced attacker isn't satisfied with a single access point: they seek to evade detection controls and establish persistence, that is, mechanisms that let them return even if the initial access is lost or the system restarts. Evasion techniques include obfuscating malicious code to avoid antivirus signatures, using legitimate operating system binaries to carry out malicious actions (living off the land) and manipulating logs to erase traces of activity. Persistence, for its part, is achieved through scheduled tasks, autostart registry keys, new service accounts or implants in the system's boot chain. For a red team, mastering these techniques in a controlled way is essential because it replicates exactly what a real adversary would do, and for a blue team, understanding them is the only way to build specific detections, since looking only for known malware completely misses these techniques based on legitimate tools.