Malware And Hunting For Persistence: How Adversaries Exploit Your Windows?

The talk looks at how malware and attackers keep access on Windows machines so they survive reboots. It starts with well-known persistence methods used by malware families and threat groups, including DLL replacement, accessibility feature abuse, alternate data streams, services and logon helpers, and explains why these classic approaches are easy for forensic tools and EDR products to spot.

The core of the presentation covers less common persistence paths found through the speaker's own research. These include registry values tied to Windows Error Reporting that can load a DLL during a debugger-style run, and Windows cryptography settings where an offload-related registry value and a Microsoft cryptographic provider DLL can be swapped so attacker code runs during routine crypto operations. The speaker notes that Microsoft Defender also uses one of these providers, so the same path could support antivirus evasion. The final section examines Process Hacker 2, a tool popular with analysts, where the speaker reports DLL hijacking exposure and a way to strip privileges from a Defender process token. The speaker says the vendor treated the issue as fixed only in a later branch.

The takeaway is that persistence research does not have to stay on classic tricks. Reviewing Windows internals and open-source projects can reveal new paths. Defenders, especially responders and threat hunters who rely on older analysis tools, should check the versions they run and make sure their detection covers these locations. Demonstrations were shown during the talk, and the speaker mentioned follow-up material in a workshop.