312-50 Question 151
Single answer▪ Establishing PersistenceDuring an authorized internal red-team engagement, you gain administrative access to a Windows 10 workstation that is used by a finance manager. The client has asked you to demonstrate a persistence method that survives a user logoff and system reboot, while minimizing operational impact and avoiding changes that would require a signed driver or kernel modification. Which persistence technique is the MOST appropriate for this objective?
- A
Create a Scheduled Task configured to run a payload at system startup with highest privileges
- B
Install a new kernel-mode driver that loads during boot to launch the payload
- C
Inject the payload into the current explorer.exe process and rely on the process remaining active
- D
Modify the ARP cache on the workstation so traffic is redirected to a command-and-control host
Show answer and explanation
Correct answer: A
Explanation
The key requirement is persistence that survives logoff and reboot without using kernel-level techniques. On Windows, Scheduled Tasks are a well-known and realistic persistence mechanism because they can trigger on startup, user logon, or other events and can be created with built-in administrative tooling such as schtasks.exe or Task Scheduler. This makes them practical in both real-world administration and adversary tradecraft. By contrast, kernel drivers are more complex, riskier, and constrained by modern Windows protections such as driver-signing requirements. Process injection is an execution technique, not durable persistence by itself. ARP cache changes affect networking behavior temporarily and do not establish host persistence. Microsoft documentation for Task Scheduler and schtasks supports the behavior of tasks running at startup or logon, and common defensive guidance from Microsoft and ATT&CK identifies Scheduled Task/Job as a recognized persistence technique.
- A. Correct.
Correct. A Scheduled Task is a common and practical Windows persistence technique that can be configured to run at startup or logon, survive reboots, and execute with elevated privileges if permissions allow. It does not require kernel-level changes or a signed driver. In a real assessment, this aligns with the requirement to demonstrate persistence with relatively low operational impact compared with more invasive methods.
- B. Incorrect.
Incorrect. Installing a kernel-mode driver is far more invasive, introduces higher risk to system stability, and on modern Windows systems typically requires driver signing enforcement considerations. This does not fit the requirement to avoid methods needing a signed driver or kernel modification.
- C. Incorrect.
Incorrect. Process injection into explorer.exe may provide short-term execution, but it is not a reliable persistence mechanism across user logoff or system reboot. Once the process terminates or the host restarts, the access is lost unless paired with another persistence method.
- D. Incorrect.
Incorrect. ARP cache manipulation is not a host persistence mechanism. ARP entries are temporary network-layer mappings used for local address resolution and do not provide durable code execution after reboot. Someone might choose this option by confusing network redirection techniques with endpoint persistence.