312-50 Question 143
Single answer▪ Maintaining AccessDuring an authorized internal penetration test, you obtain local administrator access on a Windows 10 workstation that is used by several finance employees. The rules of engagement allow you to demonstrate persistence only if it is low-noise, survives user logoff and system reboot, and is easy to remove during cleanup. The organization uses endpoint monitoring that frequently flags unknown services and obvious scheduled tasks created under unusual names. Which technique is the MOST appropriate for maintaining access under these constraints?
- A
Create a new Windows service that launches a reverse shell at startup
- B
Add a Run key entry under HKCU for the currently logged-in user to start a payload at logon
- C
Install a WMI permanent event subscription that triggers a benign-looking command or payload execution
- D
Replace utilman.exe with cmd.exe to gain SYSTEM access from the logon screen
Show answer and explanation
Correct answer: C
Explanation
The best answer is the WMI permanent event subscription because it aligns most closely with the engagement requirements: persistence across reboot, lower operational noise than creating a new service, and easier controlled removal than more invasive system-binary tampering. In Windows environments, common persistence mechanisms include services, Run keys, scheduled tasks, startup folders, registry modifications, and WMI event subscriptions. From a red-team or ethical hacking perspective, the right choice depends on the environment's monitoring controls and the rules of engagement. Microsoft documents WMI as a management infrastructure capable of event-driven actions, which is why permanent event consumers have been abused for persistence. Defenders and frameworks such as MITRE ATT&CK also recognize WMI event subscription as a persistence technique. In contrast, services and scheduled tasks are often high-signal artifacts for EDR tools, HKCU Run keys are user-dependent and less durable on shared systems, and replacing utilman.exe is an obvious and risky backdoor that is generally inconsistent with low-impact, professionally managed persistence demonstrations.
- A. Incorrect.
Incorrect. A new Windows service can provide persistence across reboot, but the scenario specifically states that endpoint monitoring frequently flags unknown services. Creating a service is also comparatively noisy and often reviewed during incident response. While technically valid as a persistence method, it does not best satisfy the operational constraints in the question.
- B. Incorrect.
Incorrect. A Run key under HKCU is simple and easy to remove, but it only applies to a specific user profile and typically requires that user to log on again. It does not reliably survive user logoff in the sense of maintaining active access, and it is less suitable on a shared workstation used by multiple employees. It also does not best meet the requirement for low-noise, durable persistence compared with other methods.
- C. Correct.
Correct. A WMI permanent event subscription is a known Windows persistence technique that can survive reboots, operate without creating a conspicuous new service, and can be configured to trigger under specific system or user events. In a scenario where new services and obvious scheduled tasks are monitored, WMI event consumers are often a quieter persistence option. They are also removable during cleanup if properly documented during the engagement.
- D. Incorrect.
Incorrect. Replacing utilman.exe with cmd.exe is a well-known backdoor technique, but it is intrusive, high risk, and likely to be detected during integrity checks or by defenders familiar with accessibility-binary abuse. It also modifies a protected system binary, making it harder to justify as a low-noise, easy-to-remove persistence method in a professional engagement.