Long-term persistence is a malware design goal or technique that keeps malicious code active on a system for an extended period. Instead of relying on a single run, the malware creates ways to survive reboots, updates, cleanup attempts, or partial removal. Common methods include registry run keys, scheduled tasks, services, startup folders, injected code, or abuse of legitimate software components.
It matters because persistence gives attackers time to steal data, move laterally, and adapt their tooling without having to reinfect the victim. In modular malware, persistence may be separated from the loader or payload so operators can swap components while keeping access alive. Defenders look for unusual process chains, unexpected DLL loads, unauthorized services, and files that reappear after deletion. Detecting persistence often requires behavioral monitoring, not just scanning for a known filename or hash.