I know that if you were to gain access to a system and restart it, an implanted backdoor would be killed. Or if you were to locate the backdoor in task manager you would be able to kill it. However, I'm interested to know other than adding to the windows registry and startup folder how else could a backdoor gain persistence?
You just need a way of reliably starting the process after the machine has booted.
This can range from -
- asking Windows or another process to start it on boot (service, startup application etc)
- Replacing or patching an executable or library known to be called at or soon after boot. This can include drivers.
- Hijacking a common user action - for example modifying Google Chrome shortcuts to launch your own process (which in turn starts the original application to stop the user realizing).
- Replace / patch bios / firmware running on a hardware device.
- Use a bootkit / hypervisor to start your code before the operating system.
- Physical hardware based attack - something like a malicious RAM module that injects code.
You can also do things like modify the firewall and service settings to allow reinfection remotely.
Persistence is always the central point of any infection to keep it simple, in addition to the use of windows Registry (since you seem talking only about Windows targets) malwares can use these techniques in order to persist :
And the list can grow to the infinite its all about how clever are the developers :)
You can get an idea of the lots of different ways of AutoStarting something by checking out the tabs that the free Autoruns utility has (from SysInternals/Microsoft, available at https://docs.microsoft.com/en-us/sysinternals/downloads/autoruns)
see below the number of tabs at this screenshot from the MSDN doc page, I can count 18 tabs apart from the "Everything" one