Elevated host persistence is the process and methods of maintaining elevated privileges on a compromised host. It is even more important to maintain host persistence after gaining elevated privileges on a host. The methods, however, may differ from the ones available for regular users, as SYSTEM (and other machine accounts) is not domain-joined and can be blocked from certain channels (e.g. web proxy may block C2 traffic).

Common persistence methods in Cobalt Strike: