312-50 Question 153
Single answer▪ Establishing PersistenceDuring an authorized internal red-team engagement, you obtain local administrator access on a Windows 10 workstation used by a finance manager. The client has approved testing of persistence techniques, but the rules of engagement require methods that survive a reboot while minimizing changes that are likely to break applications or trigger obvious user-facing issues. Which technique is the MOST appropriate for establishing persistence under these constraints?
- A
Create a Scheduled Task that runs a trusted administrative utility or approved payload at user logon or system startup
- B
Perform a Pass-the-Hash attack against the domain controller so access can be regained later without touching the workstation
- C
Run Mimikatz and dump LSASS memory on every boot to recover credentials when needed
- D
Flood the ARP cache with spoofed entries so the workstation continues redirecting traffic after reboot
Show answer and explanation
Correct answer: A
Explanation
The best answer is the Scheduled Task. In Windows environments, common persistence methods include Scheduled Tasks, Run/RunOnce registry keys, services, WMI event subscriptions, and startup folder items. Among these, a Scheduled Task is often one of the most practical and least disruptive methods during an authorized engagement because it uses built-in OS functionality, survives reboot, and can be tied to startup or user logon. Microsoft documents Task Scheduler as a legitimate automation mechanism, which is why both administrators and attackers use it. By contrast, Pass-the-Hash and LSASS dumping support credential access or lateral movement, not persistence on the original host, and ARP spoofing is a transient network attack. From a defensive standpoint, blue teams should monitor Task Scheduler operational logs, startup execution points, and changes to task definitions, consistent with Windows security monitoring best practices and ATT&CK mappings for Scheduled Task/Job persistence.
- A. Correct.
Correct. Creating a Scheduled Task is a common Windows persistence technique that can survive reboots and can be configured to trigger at startup or logon. From an operational perspective, it is less disruptive than kernel-level modifications or actions that depend on volatile state. In an authorized assessment, this is a practical way to validate whether defenders detect persistence through Task Scheduler artifacts, event logs, and startup execution monitoring. It also aligns with Windows' legitimate administration mechanisms, making it realistic and exam-appropriate.
- B. Incorrect.
Incorrect. Pass-the-Hash is a lateral movement and authentication abuse technique, not a persistence mechanism on the compromised endpoint itself. It may help an attacker regain access to other systems if valid NTLM hashes are available, but it does not establish a reboot-persistent foothold on the finance manager's workstation. A candidate might choose this because it can enable future access, but it does not meet the scenario's requirement for persistence on that host.
- C. Incorrect.
Incorrect. Dumping LSASS with tools such as Mimikatz is primarily a credential access technique, not a persistence method. In addition, configuring repeated LSASS dumping on boot is highly noisy, likely to be detected by EDR, and may violate the scenario's requirement to minimize obvious impact. Someone might select this because recovered credentials can help regain access, but that is not the same as maintaining a persistent execution mechanism after reboot.
- D. Incorrect.
Incorrect. ARP spoofing manipulates local network traffic and is generally temporary; ARP cache entries are not a reliable reboot-persistent foothold. This technique is associated with man-in-the-middle attacks rather than host persistence. A candidate might confuse network interception with persistence, but it does not satisfy the requirement to survive a reboot on the target workstation.