TechKnowSurge

VideoSecurityFree

Installation and Persistence

The installation phase of the cyber kill chain covers how adversaries establish persistence within a compromised network, ensuring continued access even if initial entry points are discovered. Techniques include staged malware delivery, scheduled tasks, SSH key creation, and backdoor account creation across local and domain systems.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

The installation phase of the cyber kill chain begins after an adversary has successfully exploited a vulnerability and gained entry into a target network. At this stage, the primary goal shifts from gaining access to securing and expanding it. Because a single, large malware payload is easier for security tools to detect, attackers typically use a staged delivery approach, introducing malicious components incrementally to avoid triggering defenses while gradually increasing their level of control over the environment. Persistence is the defining objective of this phase. Adversaries work to ensure their access survives system restarts, password changes, and other disruptions that could sever their connection to compromised systems. Common techniques include creating new local or domain accounts, adding SSH authorization keys, and scheduling tasks or jobs that automatically reinstate access if it is lost. Where directory services such as Active Directory are present, attackers may target them specifically to establish accounts with broad, organization-wide reach. Although the installation phase maps most directly to the persistence tactic in the MITRE ATT&CK framework, it frequently overlaps with several other tactics, including privilege escalation, defense evasion, credential access, and lateral movement. Taken together, these activities allow an adversary to embed themselves deeply within a network, creating multiple redundant backdoors that remain viable long after the initial compromise is detected and the original entry point is closed.

What you'll learn

Explain the purpose of the installation phase within the Cyber Kill Chain, including how adversaries use staged delivery and persistence techniques to maintain long-term access to a compromised network
Identify common persistence techniques used by adversaries, such as scheduled tasks, SSH key creation, and unauthorized account creation, as cataloged in the MITRE ATT&CK framework

What's covered

Installation & Persistence

Cyber Kill Chain Context
- Reconnaissance & Weaponization
  - Longest prep phase
- Delivery & Exploitation
  - Gains initial access
- Installation Phase
  - Post-access activities
Staged Malware Delivery
- Avoid detection risk
- Deliver components gradually
- Foot in door first
Persistence Techniques
- SSH authorization keys
- Scheduled jobs or tasks
- Creating new accounts
  - Local account access
  - Domain account access
MITRE ATT&CK Mapping
- Persistence tactic
- Privilege escalation
- Defense evasion
- Lateral movement
Backdoor Creation
- Maintain long-term access
- Active Directory exploitation
- Survive credential changes

Key terms

Cyber Kill Chain: The Cyber Kill Chain is a Lockheed Martin threat model describing the seven stages of a targeted cyberattack — reconnaissance, weaponization, delivery, exploitation, installation, command and control, and actions on objectives — used to structure defensive strategies.
Persistence: A MITRE ATT&CK tactic in which an adversary maintains their foothold within a compromised network to survive restarts, credential changes, or other interruptions.
Staged Delivery: An attack technique where malware is delivered in separate components over time to avoid detection and incrementally establish control over a target network.
MITRE ATT&CK: A globally accessible knowledge base that categorizes adversary tactics and techniques based on real-world observations, used to understand and defend against cyber threats.
Backdoor: A hidden method of bypassing normal authentication or security controls to gain unauthorized access.
Secure Shell: A cryptographic network protocol that provides secure remote login and command execution over an unsecured network.
Active Directory: Microsoft's directory service used to manage users, computers, and resources in a network.
Privilege Escalation: An attack that exploits vulnerabilities to gain higher-level access than originally authorized.
Scheduled Task: A persistence technique in which an adversary configures the operating system to automatically execute malicious code at specified times or trigger events.

Topics

Cyber Kill Chain Persistence Techniques Mitre Attck Scheduled Tasks Malware Delivery Threat Hunting Cybersecurity

Transcript

From the point in time an adversary starts looking into the network to the point in time they've actually hacked into it can be a while; it could take a lot of time. And once they're in the network, they're not going to want to lose their foothold. They're going to want to gain persistence within the network, so they're going to do some sort of installation for persistence.

Where installation fits in the kill chain

The reconnaissance and weaponization phase is all the prep work to get into the network, and it takes the longest to do. Delivery and exploitation can go pretty quick, and that's how they gain access into the network. Once they're within the network, there are a lot of things an adversary is going to do to explore and exploit that network, and some of that comes into this installation phase. The installation phase is where they're going to want to gain some persistence and be able to start controlling and looking for things within the environment.

In one of my other lessons, I talked about staged delivery of different components of malware. If we just build one humongous piece of malware and send it in, one that does everything we want it to do within the organization, there's a higher chance that it's going to get caught and we're not going to be able to carry out any kind of exploitation on the network. So what we're going to do is stage things. We're going to deliver this in components. We just need to get our foot in the door within a target network, and then once our foot is in the door, we can start getting other components of this installed. Hence the installation phase: we might be delivering different parts of this into the system and installing it to gain a foothold, to gain more control over the environment.

Persistence

A big part of this is persistence: getting into the network, controlling it, and making sure that if somebody discovers the software we're using to gain the initial access, we still have other infected systems within the network, or other ways to get into the network. So a big part of this installation phase in the cyber kill chain relates to persistence in the MITRE ATT&CK. However, I do consider installation as covering multiple areas. There might be aspects of it in privilege escalation, defense evasion, credential access, and lateral movement. All of these components sit inside of the installation. As the installation is just installing wherever we're going to persist within the network, we continue to install and explore that network.

If we get into MITRE ATT&CK and click on the persistence tactic, we can find out more information. Persistence consists of techniques that adversaries use to keep access to the system across restarts, changed credentials, and other interruptions that could cut off their access. It shows us a bunch of different methods of doing this, like creating SSH authorization keys that we could get back into the systems with, or scheduling jobs or tasks that reimplement things if we were to lose access somehow. Perhaps we get other access or login credentials to other parts of the system. There's also creating accounts, creating separate accounts that give us some local access or domain account access. It's really a way to create some sort of long-term stability with our access into this network.

So a key part of this is to create back doors into systems. If they've gotten into this system, maybe they create another account on it, and then they start realizing this is an Active Directory domain, and maybe they can get into the Active Directory, or whatever the directory services are for this network, and be able to create accounts there. The idea behind this is creating back doors that they can get in through at a later date.

Read the full transcript Show less

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →