Adversary tradecraft 101: Hunting for persistence using Elastic Security (Part 2)

This Elastic Security blog post reviews Windows persistence techniques—scheduled tasks (T1053) and BITS jobs (T1197)—illustrating real-world usage by threat actors (e.g., APT34, QBot) and providing practical detection/hunting guidance including EQL queries, relevant command-line indicators, PowerShell cmdlets, and recommended telemetry sources for defenders.