Persist with a WMI permanent event subscription
A filter-to-consumer binding stored in the WMI repository runs your payload on an event trigger with no file on disk and no Run key.
Tag: persistence
Hijack a writable or PATH-relative systemd unit
A root-run service with a writable unit file or a relative ExecStart lets an unprivileged user execute code as root on the next start.
Persistent injection via RAG index poisoning
Anything you can write that later gets embedded becomes a stored injection that fires whenever a similar query retrieves it.