GIAC
GCFE · Question #148
An examiner wants to identify persistence via Run keys. Which Registry location should they check?
The correct answer is A. HKLM\Software\Microsoft\Windows\CurrentVersion\Run. See the full explanation below for the reasoning.
Question
An examiner wants to identify persistence via Run keys. Which Registry location should they check?
Options
- AHKLM\Software\Microsoft\Windows\CurrentVersion\Run
- BHKLM\Software\Classes
- CHKCU\ControlSet\Enum
- DUSN Journal
How the community answered
(22 responses)- A73% (16)
- B14% (3)
- C5% (1)
- D9% (2)
Community Discussion
No community discussion yet for this question.