Persistent credentials are authentication material-such as passwords, API keys, OAuth secrets, certificates, or access tokens-that an attacker adds or retains to regain access after an initial compromise. Unlike a one-time login, these credentials can maintain access even if the original foothold is removed.
Attackers may create a new application secret, add a key to a service principal, or steal credentials used by a trusted integration. In cloud environments, that can let them authenticate as an application and use its existing permissions, potentially across multiple tenants. Defenders should review identity and audit logs for unexpected credential additions, app permission changes, and unusual service-principal activity. Removing the malicious material and checking for other persistence methods helps prevent re-entry.