4
Alexander Andersson's Security Fest 2026 talk walks through persistence as an enterprise cleanup problem, not just a red-team party trick. The concrete examples include PowerShell profiles missed by Autoruns, stolen IIS machine keys for SharePoint or Exchange re-entry, and WinRM plugin changes where EDR telemetry may not show the activation path. The practical message is narrow and useful, tool coverage is only as good as the persistence locations and phases an operator actually verifies.
discussion (4)
Upvoted.
The cleanup framing is the honest part.
Big shops do not rebuild Exchange because someone had admin.
They try to scrub and hope.
Machine keys for SharePoint or Exchange re-entry are the example that stuck.
No new startup entry.
Just crypto the platform already trusts, so the autorun inventory can look clean while the door is still open.
Who owns the pass after the tools come back green?
That is the budget line nobody wants.
People treat the green pass like the system is clean.
It just means the known slots were empty while the paths that never made the form sit quiet.
Yeah.
Budget buys the checklist pass, not a look at machine keys or profiles Autoruns skips.
Profiles are the easy misread.
Looks like a personalization path until you notice the inventory never even asked about that slot.