# Host Persistence Audit

**ID**: S1007

**Description**: Once an attacker is on a system, a main goal becomes trying to maintain that access. Persistence mechanisms give the attacker the ability to run malware that will survive reboots and credential changes.

## Was a browser extension used to maintain a foothold? <span class="dfiqIdTag">F1019</span>

 - <span class="dfiqIdTag">Q1021</span> &nbsp;What Chrome extensions are installed?
 - <span class="dfiqIdTag">Q1052</span> &nbsp;What browser extensions (non-Chrome) are installed?
## Are there any interesting logon or boot initialization scripts? <span class="dfiqIdTag">F1020</span>

 - <span class="dfiqIdTag">Q1053</span> &nbsp;What Launch Agents are configured?
 - <span class="dfiqIdTag">Q1054</span> &nbsp;What Launch Daemons are configured?
 - <span class="dfiqIdTag">Q1055</span> &nbsp;What Windows logon scripts are configured?
 - <span class="dfiqIdTag">Q1056</span> &nbsp;What login hooks are configured?
 - <span class="dfiqIdTag">Q1057</span> &nbsp;What network logon scripts are configured?
## Are there any new accounts that have been created? <span class="dfiqIdTag">F1021</span>

 - <span class="dfiqIdTag">Q1058</span> &nbsp;What domain accounts have been created?
 - <span class="dfiqIdTag">Q1059</span> &nbsp;What local accounts have been created?
## Are there any scheduled/automated tasks that ran? <span class="dfiqIdTag">F1022</span>

 - <span class="dfiqIdTag">Q1060</span> &nbsp;What AT jobs are configured?
 - <span class="dfiqIdTag">Q1061</span> &nbsp;What Scheduled Tasks are configured?
 - <span class="dfiqIdTag">Q1062</span> &nbsp;What cron jobs are configured?
 - <span class="dfiqIdTag">Q1063</span> &nbsp;What periodic scripts are configured?
 - <span class="dfiqIdTag">Q1064</span> &nbsp;What systemd timers are configured?
## Are there any suspicious files running at system boot or login autoruns? <span class="dfiqIdTag">F1023</span>

 - <span class="dfiqIdTag">Q1065</span> &nbsp;What files are referenced in Registry "Run" keys?
 - <span class="dfiqIdTag">Q1066</span> &nbsp;What items are in startup folders?
## Has a system process been created or modified? <span class="dfiqIdTag">F1024</span>

 - <span class="dfiqIdTag">Q1067</span> &nbsp;What system services are installed?
 - <span class="dfiqIdTag">Q1068</span> &nbsp;When were system services last modified?
## Are there any indications of hijacking execution flows? <span class="dfiqIdTag">F1025</span>

 - <span class="dfiqIdTag">Q1069</span> &nbsp;Are there any indications of dylib hijacking?
 - <span class="dfiqIdTag">Q1070</span> &nbsp;Are there any indications of dylib proxying?
 - <span class="dfiqIdTag">Q1071</span> &nbsp;Are there any indications of dynamic linker hijacking?
