Install agent persistence via StartUp batch file

A batch file (.bat) located in the Windows StartUp folder may be used for persistence. This procedure generates a batch file and places it in the StartUp folder. On startup, the file will execute a spawn a new Pneuma agent.
View Command

To view this TTPs command, you must be logged in with a professional or enterprise license.


Test this TTP

Download Operator (1.7.1)
Test this TTP using one of our Operator chains
APT40 maritime industry


Emulating APT40's malware persistence techniques.