Tick APT employs persistence techniques, modifying registry entries and creating scheduled tasks to ensure continued access to the compromised system. The attacker created a new scheduled task and modified a registry entry to maintain access.