# Persistence Mechanism Detection

## Overview
Post execution of Mivast, persistence mechanisms were identified, ensuring prolonged access for the attackers.

## Findings
- **Scheduled Tasks**: Attackers established persistence using scheduled tasks that execute malicious scripts at regular intervals.
- **Registry Changes**: Modifications detected in the Windows Registry, enabling backdoor re-execution on startup.

## Recommendations
- Review and clean scheduled tasks across all endpoints.
- Restore Registry settings to defaults, ensuring no malicious entries remain.

## Next Steps
Investigate lateral movement within the network, especially towards high-value targets like patient records.