Persistence means an attacker arranges to keep access after the first entry is closed. Advisories describe valid credentials, added cloud credentials and federation trusts, not just malware on disk. Removing one implant leaves the others, so response should look for every way back in.
What advisories describe
CISA's Volt Typhoon advisory says the actor primarily relies on valid credentials for persistence, repeatedly extracting NTDS.dit from domain controllers to keep credentials fresh. It reports footholds lasting at least five years.
CISA's SolarWinds alert describes the actor adding credentials to Azure and Microsoft 365 service principals and adding federation trusts for persistence. It also describes abuse of SAML tokens forged with a stolen signing certificate.
MITRE's Persistence tactic page defines the goal in one line: the adversary is trying to maintain their foothold.
Four families of persistence
- Credentials. Stolen or created accounts and secrets. MITRE's Valid Accounts technique spans Persistence as well as Initial Access.
- Identity trust. Federation trusts, token signing material and service principals.
- Software on the host. Implants, scheduled jobs and modified binaries.
- Network footholds. Changed device configurations and added remote access paths.
Clean-up often focuses on family three because it is easiest to see.
A hunt plan for the other three
Credentials. List accounts created or changed in the intrusion window. Check service accounts for new secrets or unusual interactive use.
Identity trust. Review federation settings, token signing certificates and service principal credentials. Look for changes you did not approve.
Network footholds. Compare device configurations with a known good baseline. Check for new VPN accounts and new admin users.
Order of operations
Scope first. If you remove a visible implant while access through credentials or trust remains, the attacker learns they were noticed and may change tactics. Plan eviction as a coordinated step after you map persistence, and see what recovery means when advisories say assume domain compromise.
Prove the eviction
After recovery, watch for return. Raise alerting for the accounts and systems involved, keep extended log retention and run the same hunt a few weeks later.
Questions to ask in every review
- What would let the attacker back in if I did nothing more today?
- Which credentials were exposed on systems that were touched?
- Which trusts, tokens and service accounts can an administrator add silently?
- Who gets alerted when those change?
Quick check
Is persistence always malware?
No. Advisories describe persistence through valid credentials, added cloud credentials and federation trusts as well.
When should we evict the attacker?
After scoping, so removal is coordinated across the persistence methods you found.
Sources
Last reviewed: 19 October 2026.
