Persistence
Persistence is the use of mechanisms that let an attacker maintain access despite interruptions such as restarts, credential changes, or attempts to remove them.
What lets the attacker come back?
Persistence can involve software that runs again after a restart, but it is not limited to malware. MITRE also documents account changes, additional credentials, roles, and email delegate permissions that can preserve access.
The mechanism matters. Resetting a user’s password does not necessarily remove a separate account, application credential, or permission that was added during the intrusion. The identity containment review explains why those access paths need their own checks.
Initial access is about getting in. Persistence is about staying able to get in. Lateral movement reaches other systems or resources, while privilege escalation increases authority. One action can serve more than one of those purposes.
Establish the change and its effect
A delegate assignment or federation relationship may be legitimate. Its existence alone does not prove persistence. Compare the configuration with approved changes, identify who created it, and investigate the access it permits.
The mailbox-delegation article follows a permission decision; the federation article examines who an identity system trusts. Both help explain why recovering the original account may leave other changes unresolved.