47How does Windows run services and hold credentials in LSASS, and why are services and LSASS central to both attack and defence?▼mediumNewMicrosoftCrowdStrikePalo Alto Networks◆ premiumTwo things make Windows compromise spread: services that run with powerful identities, and a process that holds the credentials of everyone logged on.Open full answer →
22Where does malware hide to survive a reboot on Windows, Linux and macOS, and how do defenders find and prevent persistence?▼mediumNewCrowdStrikeMicrosoftApple◆ premiumGetting in once is not enough for an attacker. Persistence is where they must leave a mark on the system, which makes it one of the best places to catch them.Open full answer →
09How do you stop injected instructions from persisting through agent memory or long-term state?▼hardNew○ sign inFollow the write, retrieval and execution paths separately. A remembered claim can persist without becoming policy; prove which records later tasks receive and which actions the resource service permits.Open full answer →