Startup folder Copy payload to startup folder SharpPersist Registry keys Query and set reg key Can use HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run or HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce Cleanup reg delete “HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run” /v MSUpdate /f Launch programs or set folder items SharpPersist Scheduled task Create, Query and run task Create task the user session is idle for…