Persistence survives system reboots — registry run keys, scheduled tasks, Windows services, DLL hijacking, WMI subscriptions, SSH authorized_keys, cron jobs.
After initial compromise, establishing persistence is the attacker's first priority. Detection: Autoruns (Sysinternals) shows all Windows persistence points. Monitor for new/modified scheduled tasks, services, and registry run keys. EDR behavioral alerts fire on suspicious persistence establishment.