> For the complete documentation index, see [llms.txt](https://red.infiltr8.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://red.infiltr8.io/redteam/persistence/windows.md).

# Windows

- [Accessibility features Backdoor](https://red.infiltr8.io/redteam/persistence/windows/accessibility-features-backdoor.md): MITRE ATT\&CK™  Event Triggered Execution - Accessibility Features - Technique T1546.008
- [AEDebug Keys Persistence](https://red.infiltr8.io/redteam/persistence/windows/aedebug-keys.md)
- [Image File Execution Options (IFEO) Persistence](https://red.infiltr8.io/redteam/persistence/windows/image-file-execution-options.md): MITRE ATT\&CK™ Event Triggered Execution: Image File Execution Options Injection - Technique T1546.012
- [Logon Triggered Persistence](https://red.infiltr8.io/redteam/persistence/windows/logon-triggered.md): MITRE ATT\&CK™ Boot or Logon Autostart Execution - Technique T1547
- [LSA Persistence](https://red.infiltr8.io/redteam/persistence/windows/lsa.md)
- [Security Support Provider DLLs](https://red.infiltr8.io/redteam/persistence/windows/lsa/security-support-provider-dlls.md): MITRE ATT\&CK™ Boot or Logon Autostart Execution: Security Support Provider - Technique T1547.005
- [Authentication Package](https://red.infiltr8.io/redteam/persistence/windows/lsa/authentication-package.md): MITRE ATT\&CK™ Boot or Logon Autostart Execution: Authentication Package - Technique T1547.002
- [Natural Language 6 DLLs Persistence](https://red.infiltr8.io/redteam/persistence/windows/natural-language-6-dlls.md)
- [Run Keys Persistence](https://red.infiltr8.io/redteam/persistence/windows/run-keys.md): MITRE ATT\&CK™ Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder - Technique T1547.001
- [Winlogon Persistence](https://red.infiltr8.io/redteam/persistence/windows/winlogon.md): MITRE ATT\&CK™ Boot or Logon Autostart Execution: Winlogon Helper DLL - Technique T1547.001
- [WMI Event Subscription Persistence](https://red.infiltr8.io/redteam/persistence/windows/wmi-event-subscription.md): MITRE ATT\&CK™  Event Triggered Execution: Windows Management Instrumentation Event Subscription - Technique T1546.003