Tag

#Persistence

3 articles covering Persistence across campaign analysis, detection engineering, and defender tradecraft.

Coverage

3 entries

Field Analysis

Blue TeamCampaign AnalysisOct 6, 202610 min read

Two RMM Agents Are Not Redundancy, They Are Persistence

Microsoft documented a July 2026 campaign dropping MSP360 RMM v2.5.0.67 as the initial agent and ConnectWise ScreenConnect as a second channel. ANY.RUN tracked the wider operation across 46 countries, with 94% of its kit URLs alive for a single day.

By PhishPond Desk

Field Analysis

Dual UseTradecraft LabsJun 7, 202611 min read

The Step After the Click: Five Persistence Primitives That Survive Your Response

Mailbox rules, OAuth grants, replayed sessions, RMM agents, and downstream account changes are not the aftermath of an intrusion — they are the point. A field guide to the persistence layer most response playbooks still treat as cleanup.

The Procedure Is the Threat: Why an Intrusion's Shape Outlives Its Toolkit

Runtimes, platforms, and brands rotate every quarter. The six handoffs that move a victim from manufactured urgency to durable persistence have barely changed in five years, and they are what defenders can actually build for.

By PhishPond Desk

#Persistence

Coverage

Browse Other Tags