PersistBOF - Tool To Help Automate Common Persistence Mechanisms

A tool to help automate common persistence mechanisms. Currently supports Print Monitor (SYSTEM), Time Provider (Network Service), Start folder shortcut hijacking (User), and Junction Folder (User)

Usage

Clone, run make, add .cna to Cobalt Strike client.

run: help persist-ice in CS console

Syntax:

• persist-ice [PrintMon, TimeProv, Shortcut, Junction] [persist or clean] [key/folder name] [dll / lnk exe name];

Technique Overview

All of these techniques rely on a Dll file to be seperately placed on disk. It is intentially not part …

hijacking persistence registry tool windows