Persistence

← All KQL categories

MITRE ATT&CK Tactic

Persistence

6 queries tagged with this tactic.
View on MITRE ATT&CK →

• Analytics Rules Detect Unsigned Dll Load Verified Signing State

  Unsigned DLL loads, using IsSigned/SigningStatus rather than treating an empty SHA256 as unsigned (the field is documented as usually-populated, not always).

• Hunting Hunt Cav3rn Endpoint Local Log File Artifact

  Endpoint-side hunt for Project CAV3RN's local file artifact (`logAzure.txt` and family) — config persistence written by the module.

• Hunting Hunt First Time Admin Operation User Baseline

  Baselines identities that have ever executed admin operations, then alerts when an account outside that set succeeds — 'the admin who has never administered.'

• Hunting Hunt Npm Postinstall Config Modification No User Context

  npm postinstall/lifecycle scripts that modified config without a corresponding interactive user command — AsyncAPI-shaped supply-chain compromise.

• Hunting Hunt Outlook Calendar C2 Far Future Standing Meeting

  Project CAV3RN's Outlook calendar C2 — standing meetings scheduled decades in the future in fixed low-attention windows, carrying operator-agent traffic in the event body.

• Hunting Hunt Suspicious User Consented Oauth App Grants

  'The backdoor you approved yourself' — OAuth application consents granting broad Graph permissions to unfamiliar apps. Focuses on CONSENT events, not the logins that follow.