# Establishing Backdoor - TA505 Persistence

After the macro execution, TA505 aims to establish persistence within the network. This involves setting up a backdoor that allows continuous access.

## Key Indicators:
- **Registry Modifications**: Changes were detected in the Windows Registry to ensure the backdoor starts with the system.
- **Scheduled Tasks**: New tasks were scheduled to run malicious scripts at regular intervals.
- **Network Traffic**: Outbound connections to known TA505 command and control (C2) servers were observed.

## Mitigation Strategies:
- Regularly audit registry and scheduled tasks for unauthorized changes.
- Monitor network traffic for anomalies and block known malicious IPs.