Uh-Oh...

It is only used in large-scale attacks is incorrect.

Explanation :

Detecting persistence is difficult because it is designed to be stealthy, mimicking normal activity to remain undetected for as long as possible.