While investigating an alert in the CrowdStrike Falcon platform, you discover a registry key modification in HKCU\Software\Microsoft\Windows\CurrentVersion\Run referencing a newly created executable i

Question

Options

• AA malicious persistence mechanism designed to execute malware at startup.
• BA harmless system optimization script configured to run on boot.
• CAn update to a legitimate application stored in the AppData directory.
• DA routine application installation adding itself for automatic startup.

• A
  75% (36)
• B
  6% (3)
• C
  15% (7)
• D
  4% (2)

Explanation

Option A: The HKCU\Software\Microsoft\Windows\CurrentVersion\Run registry key is a common persistence mechanism used by malware. The presence of a new executable in the AppData\Roaming directory is particularly suspicious, as this directory is often exploited by attackers to store malicious files. Further investigation is necessary to analyze the executable and mitigate the threat. Option B: System optimization scripts rarely require registry modifications for persistence and are generally stored in predefined system directories, not AppData. The context points more toward malicious activity. Option C: While some applications use AppData for updates, they generally overwrite existing files rather than create new executables with corresponding registry entries. Validate this scenario against update logs and application behavior. Option D: Legitimate applications may add entries to this registry key, but these are typically well- documented and located in program directories, not AppData\Roaming. The context of the directory and newly created executable makes this explanation less likely.

No community discussion yet for this question.