> For the complete documentation index, see [llms.txt](https://windows.dfirhandbook.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://windows.dfirhandbook.com/windows-artifacts/persistence.md).

# Persistence

- [Registry](https://windows.dfirhandbook.com/windows-artifacts/persistence/registry.md)
- [NTUSER.DAT & HKU\SID](https://windows.dfirhandbook.com/windows-artifacts/persistence/registry/ntuser.dat-and-hku-sid.md)
- [Run and Run Once](https://windows.dfirhandbook.com/windows-artifacts/persistence/registry/run-and-run-once.md)
- [Shell Folders and UserInit Key](https://windows.dfirhandbook.com/windows-artifacts/persistence/registry/shell-folders-and-userinit-key.md): Registry keys like Shell Folders and UserInit are integral to Windows operating systems, impacting user environments and the login process
- [Services](https://windows.dfirhandbook.com/windows-artifacts/persistence/registry/services.md)
- [Logon Scripts](https://windows.dfirhandbook.com/windows-artifacts/persistence/registry/logon-scripts.md): Logon scripts offer a way for administrators to automate tasks that should occur each time a user logs on to a Windows system.
- [Office Add-ins](https://windows.dfirhandbook.com/windows-artifacts/persistence/registry/office-add-ins.md): Office Add-ins provide enhanced functionality and customization for Microsoft Office applications, enabling users to tailor their experience with additional features.
- [Winlogon Shell](https://windows.dfirhandbook.com/windows-artifacts/persistence/registry/winlogon-shell.md): his key's default and legitimate value is meant to launch the Windows Explorer, providing the standard desktop environment.
- [Image File Execution Options (IFEO)](https://windows.dfirhandbook.com/windows-artifacts/persistence/registry/image-file-execution-options-ifeo.md): IFEO allows for the configuration of certain behaviors when specified executables are launched, including attaching a debugger or modifying certain execution parameters.
- [AppInit\_DLLs](https://windows.dfirhandbook.com/windows-artifacts/persistence/registry/appinit_dlls.md): The AppInit\_DLLs registry key provides a mechanism for specifying one or more DLLs to be loaded into all processes that use the User32.dll.
- [Scheduled Tasks](https://windows.dfirhandbook.com/windows-artifacts/persistence/registry/scheduled-tasks.md)
- [Scheduled Tasks](https://windows.dfirhandbook.com/windows-artifacts/persistence/scheduled-tasks.md)
- [Scheduled Task Destination System Artifacts](https://windows.dfirhandbook.com/windows-artifacts/persistence/scheduled-tasks/scheduled-task-destination-system-artifacts.md)
- [Scheduled Task Source System Artifacts](https://windows.dfirhandbook.com/windows-artifacts/persistence/scheduled-tasks/scheduled-task-source-system-artifacts.md)
- [Startup](https://windows.dfirhandbook.com/windows-artifacts/persistence/startup.md)
- [Tool: AutoRuns](https://windows.dfirhandbook.com/windows-artifacts/persistence/tool-autoruns.md)
- [Accounts](https://windows.dfirhandbook.com/windows-artifacts/persistence/accounts.md)
- [WMI Event Consumers](https://windows.dfirhandbook.com/windows-artifacts/persistence/wmi-event-consumers.md)
- [WMI: Source System Artifacts](https://windows.dfirhandbook.com/windows-artifacts/persistence/wmi-event-consumers/wmi-source-system-artifacts.md)
- [WMI: Destination System Artifacts](https://windows.dfirhandbook.com/windows-artifacts/persistence/wmi-event-consumers/wmi-destination-system-artifacts.md)
- [WMI: PowerShell Analysis](https://windows.dfirhandbook.com/windows-artifacts/persistence/wmi-event-consumers/wmi-powershell-analysis.md)
- [PowerShell Scripts](https://windows.dfirhandbook.com/windows-artifacts/persistence/powershell-scripts.md)
- [Startup Programs](https://windows.dfirhandbook.com/windows-artifacts/persistence/powershell-scripts/startup-programs.md)
- [CrowdStrike Searches](https://windows.dfirhandbook.com/windows-artifacts/persistence/crowdstrike-searches.md)
- [Files Written to Startup Folder](https://windows.dfirhandbook.com/windows-artifacts/persistence/crowdstrike-searches/files-written-to-startup-folder.md)
- [Files Written to Startup Folder from the Internet](https://windows.dfirhandbook.com/windows-artifacts/persistence/crowdstrike-searches/files-written-to-startup-folder-from-the-internet.md)
- [Local Account Creation/Deletion](https://windows.dfirhandbook.com/windows-artifacts/persistence/crowdstrike-searches/local-account-creation-deletion.md)
- [Azure Account Creation/Deletion](https://windows.dfirhandbook.com/windows-artifacts/persistence/crowdstrike-searches/azure-account-creation-deletion.md)
- [Scheduled Tasks](https://windows.dfirhandbook.com/windows-artifacts/persistence/crowdstrike-searches/scheduled-tasks.md)