TTPwire Vol. 1 · MITRE ATT&CK·Tagged

← All stories

Huntress

What Is a Persistent Foothold? | Huntress

2021-04-06 · Read original ↗

ATT&CK techniques detected

6 predictions
T1053.005Scheduled Task
97%
“even a scheduled task. what does a persistent foothold do? let ’ s go back to the example above. the triggered action isn ’ t to send an email or open a program. instead, it ’ s to run malware. see under the “ actions ” tab? it ’ s running an executable ( which turns out to be re…”
T1547.001Registry Run Keys / Startup Folder
93%
“? the reason why it ’ s so important to include human threat hunters when hunting for footholds is simply because these footholds are exploiting core parts of the operating system. autoruns that can create persistence — such as run keys, system trays, wmi events — are necessary f…”
T1518.001Security Software Discovery
84%
“they can learn quickly and are extremely good at discerning right from wrong. “ cyber threat hunters [ … ] must be unleashed on these networks to look for the hidden, persistent access controls. these information security professionals actively search for, isolate and remove adva…”
T1053Scheduled Task/Job
48%
“foothold has an ability to “ respawn ” so that the attacker doesn ’ t have to start from scratch and phish you again ( besides, what is the likelihood that anyone would open that same attachment twice? ). what does a persistent foothold look like? let ’ s take a foothold that hun…”
T1059.001PowerShell
47%
“even a scheduled task. what does a persistent foothold do? let ’ s go back to the example above. the triggered action isn ’ t to send an email or open a program. instead, it ’ s to run malware. see under the “ actions ” tab? it ’ s running an executable ( which turns out to be re…”
T1053.003Cron
36%
“foothold has an ability to “ respawn ” so that the attacker doesn ’ t have to start from scratch and phish you again ( besides, what is the likelihood that anyone would open that same attachment twice? ). what does a persistent foothold look like? let ’ s take a foothold that hun…”

Summary

We hunt for persistent footholds, but what exactly does that mean? In this blog, we define what a foothold is and why it's a hacker favorite.