Finding a Home for Our Shellcode
To extend the longevity of our implant,
we can execute it in a process that is unlikely to terminate.
One such process is explorer.exe,
which is responsible for hosting the user’s desktop experience.
We could also inject into a new hidden process like notepad.exe,
or we could migrate to a process like svchost.exe
that performs network communication.