During a routine system configuration audit, it was detected that IceFog is attempting to establish persistence by embedding scripts in startup folders and modifying registry keys. This ensures access even if the system is rebooted.