Persistence runbooks¶ Token theft and identity persistence Cloud IAM persistence Scheduled task and cron persistence WMI event subscription persistence