Windows persistence

Surface	Check	Pivot next
Services	New/changed service, path, account	4697/7045, binary signer/hash, creator
Scheduled tasks	Created/updated/enabled task	4698–4702, action path, author, trigger
Run keys	User/machine autoruns	Registry writer, target binary, account
Startup folders	New link/script/binary	Origin, signer, first execution
WMI subscriptions	Filter, consumer, binding	Sysmon 19–21, creator, payload
Accounts/groups	New/enabled user or membership	4720+, originating session, later logon
DLL search paths	User-writable DLL near trusted app	Loader process, module path, signature
Browser extensions	New/forced extension	Install source, policy, permissions
Office add-ins	New/changed add-in	User, file/registry source, child process

Persistence question: what causes execution again, under which identity, and when?