Process persistence uses startup mechanisms, supervisors, scheduled tasks, replicated state, or other techniques to keep software available. Legitimate services use persistence for reliability, while unauthorized processes use it to survive cleanup and retain access.
Detection requires visibility across machines and lifecycle events rather than one process snapshot. Strong access controls, signed deployments, inventory, and alerts for unexpected respawning help distinguish approved resilience from compromise.
ELI5
Process persistence is a program's ability to keep running or start again after a restart, interruption, or move to another machine. Approved services use it for reliability, while malicious software may use the same idea to survive attempts to remove it.
For example, a web service may have a supervisor that restarts it after a crash. Administrators need inventories, signed software, access controls, and alerts so they can tell that expected restart from an unknown program secretly returning.
How can a process remain persistent?
It can use service managers, startup hooks, scheduled execution, replicated state, or another process that recreates it after termination.
Is process persistence always malicious?
No. Reliable services need persistence, but an unapproved process that survives removal or crosses machines is a security concern.
