How do you detect infostealer persistence and re-infection?

Detect the loader and stealer persistence mechanisms by their target path: Run or RunOnce values and scheduled tasks (at logon, at startup or on a short interval) that run a binary from AppData, Temp, ProgramData or Public, with allowlists for known per-user installers. Then deal with what host cleanup cannot fix: revoke refresh tokens and sessions, rotate passwords and keys, re-enrol MFA, track repeat infections per user and monitor those accounts for weeks.

Detecting Infostealer Persistence and Re-Infection

A pure smash-and-grab stealer collects, uploads and deletes itself. But the loader that delivered it often persists, some families do too, and users re-infect themselves by running the same cracked installer again. Meanwhile the stolen cookies and tokens keep working after the host is clean. Detection and response must cover all three.

Signals at a Glance

Signal	Where	ATT&CK
Run or RunOnce value pointing to AppData, Temp, ProgramData or Public	Sysmon 13, EDR registry	T1547.001
Scheduled task created at logon or on a short interval running a user-writable binary	Security 4698, Sysmon 1	T1053.005
New Startup-folder item from a script or archive-extracted binary	Sysmon 11	T1547.001
Same family reappearing on the same host after remediation	EDR, case history	T1204
Stolen session or token still valid after the host is cleaned	Identity logs	T1550.004

Run Keys and Scheduled Tasks

Both mechanisms are well covered by public content. The discriminator for stealer chains is the target path: a value or task that runs a binary from a user-writable directory, particularly one with a random-looking name:

title: Run Key Value Pointing to User-Writable Path
logsource:
  category: registry_set
  product: windows
detection:
  selection:
    TargetObject|contains:
      - '\CurrentVersion\Run\'
      - '\CurrentVersion\RunOnce\'
    Details|contains:
      - '\AppData\'
      - '\Temp\'
      - '\ProgramData\'
      - '\Users\Public\'
  filter_known:
    Details|contains:
      - '\AppData\Local\Microsoft\OneDrive\'
      - '\AppData\Local\Programs\'
  condition: selection and not filter_known
level: medium
# tune/validate: many per-user installers register here; allowlist by signer and path

// Microsoft Defender (KQL) - scheduled task created to run a user-writable binary
DeviceProcessEvents
| where FileName =~ "schtasks.exe" and ProcessCommandLine has "/create"
| where ProcessCommandLine has_any ("\\AppData\\","\\Temp\\","\\ProgramData\\","\\Users\\Public\\")
| where ProcessCommandLine has_any ("onlogon","onstart","minute","/sc daily")
| project Timestamp, DeviceName, AccountName, ProcessCommandLine,
          InitiatingProcessFileName, InitiatingProcessFolderPath
// tune/validate: also review tasks created through the COM API, which bypass schtasks.exe

Re-Infection and Stolen Sessions

Cleaning the host does not invalidate what was stolen. Revoke refresh tokens and sessions, rotate passwords and API keys, and re-enrol MFA methods for every account used on the host.
Track repeat detections per device and per user. A user who is infected three times in a month is running pirated software or following a lure; fix the cause, not the symptom.
Hunt the loader’s persistence even if the stealer is gone. The loader will bring the stealer back.
Monitor sign-ins for the affected accounts for several weeks, watching for new devices, new MFA methods and mailbox rules.

Vetted sources

Use SigmaHQ Run-key and scheduled-task rules, Elastic persistence detections, Splunk ESCU analytics for scheduled task creation, and the MITRE ATT&CK T1547.001 and T1053.005 pages. Baseline per-user installers in your environment; many legitimate applications register Run keys under AppData.

Build Detections That Fire

Mjolnir Security helps blue teams turn threat intelligence into high-fidelity detections across endpoint, network, identity and cloud telemetry.

Detection EngineeringManaged Detection & ResponseThreat HuntingIncident ResponsePurple Teaming

Detection Engineering We build and tune detections mapped to ATT&CK from your own telemetry.
Threat Hunting as a Service Hypothesis-driven hunts for the behaviours on this page.
24/7 Incident Response Containment when a detection fires. Call +1 833 403 5875.

Written by: Mjolnir Threat Research (MTAC)  |  Published: October 12, 2026  |  Last reviewed: October 12, 2026

Signals at a Glance

Run Keys and Scheduled Tasks

Re-Infection and Stolen Sessions

Build Detections That Fire

Infostealer Detection

Detection Hub

Loader-to-Stealer Chain Detection

Cookie and Session Theft Detection