What is persistence in a cyberattack?
Persistence is how attackers keep their access across reboots, password changes and clean-ups: new accounts, scheduled tasks and services, remote-access tools installed as if they were legitimate, web shells on internet-facing servers, changed VPN or firewall settings, and stolen session tokens for cloud services. Most persistence lives on hosts and in identity systems, so it is found with endpoint tools, directory reviews and configuration comparisons. Check regularly for administrator accounts nobody can explain, remote-access software nobody approved and forwarding rules in mailboxes. What persistence usually needs is a connection back to the attacker, and that is visible on the network: a host that keeps calling the same outside server, even weeks after an incident was closed. NetSenX flags this beaconing on every plan.