312-50 Question 152
Single answer▪ Establishing PersistenceDuring an authorized internal assessment, you obtain local administrator access on a Windows 10 workstation used by a finance manager. The engagement rules allow you to demonstrate persistence but require you to avoid creating new user accounts, avoid installing third-party software, and minimize visible impact to the user. You also need the persistence mechanism to survive a normal reboot and execute when the user signs in. Which action is the MOST appropriate choice?
- A
Create a Run registry key under HKCU\Software\Microsoft\Windows\CurrentVersion\Run that launches a PowerShell command when the finance manager logs in
- B
Use ipconfig /displaydns to cache a malicious payload in DNS so it automatically executes after reboot
- C
Add a firewall rule that allows inbound RDP connections to the workstation for later access
- D
Clear the Windows Security event log so the persistence mechanism is less likely to be detected
Show answer and explanation
Correct answer: A
Explanation
The best answer is the HKCU Run registry key because it aligns directly with the scenario constraints: it uses a built-in Windows mechanism, survives reboot, triggers at user logon, avoids creating accounts, and does not require installing additional software. In Windows, common persistence locations include Run/RunOnce registry keys, Startup folders, scheduled tasks, services, WMI event subscriptions, and logon scripts. In this case, HKCU Run is the least disruptive and most tightly scoped to the finance manager's profile. Microsoft documents Run and RunOnce registry keys as standard startup mechanisms, and they are widely recognized in enterprise defense guidance and adversary emulation frameworks such as MITRE ATT&CK under Registry Run Keys/Startup Folder (T1547.001). The other options confuse persistence with unrelated concepts: DNS cache is not an execution trigger, a firewall rule may enable access but does not establish autorun persistence, and log clearing is anti-forensics rather than persistence.
- A. Correct.
Correct. A Run key in HKCU\Software\Microsoft\Windows\CurrentVersion\Run is a legitimate Windows autostart extensibility point commonly abused for persistence. It does not require creating a new user account or installing third-party software, survives a normal reboot, and executes when that specific user logs in, which matches the scenario requirements. Using HKCU also limits scope to the target user's session and is generally less disruptive than system-wide persistence methods.
- B. Incorrect.
Incorrect. DNS client cache entries shown by ipconfig /displaydns are not a supported persistence mechanism and will not execute a payload on reboot or user logon. This distractor targets the misconception that any cached system artifact can be used as an autostart method. In reality, DNS cache is for name resolution, not code execution.
- C. Incorrect.
Incorrect. Allowing inbound RDP may facilitate remote access, but it is not itself a persistence mechanism that guarantees execution after reboot or user sign-in. It also changes remote access exposure and may violate the requirement to minimize visible impact. Persistence is about maintaining access through an execution or re-entry mechanism, not simply opening a management port.
- D. Incorrect.
Incorrect. Clearing the Security event log is an anti-forensics action, not a persistence method. It does nothing to ensure code runs after reboot or user logon. It is also highly visible from a defensive perspective and would likely increase suspicion rather than provide stealthy persistence.