nerdexam
GIAC

GCIH · Question #737

What tool would an incident handler use to search for all autostart extensibility points (ASEPs) on a Windows host?

The correct answer is D. autoruns. Sysinternals Autoruns is the standard incident-response tool for enumerating all autostart extensibility points (ASEPs) on a Windows host. It covers far more persistence locations than any built-in Windows utility.

Incident Response & Cyber Kill Chain

Question

What tool would an incident handler use to search for all autostart extensibility points (ASEPs) on a Windows host?

Options

  • AWindows Firewall
  • BWindows Event Viewer
  • Cregedit
  • Dautoruns

How the community answered

(27 responses)
  • A
    4% (1)
  • B
    11% (3)
  • D
    85% (23)

Why each option

Sysinternals Autoruns is the standard incident-response tool for enumerating all autostart extensibility points (ASEPs) on a Windows host. It covers far more persistence locations than any built-in Windows utility.

AWindows Firewall

Windows Firewall manages inbound and outbound network traffic rules and has no capability to display or enumerate autostart programs.

BWindows Event Viewer

Windows Event Viewer shows system, security, and application log entries but does not enumerate or display ASEP locations configured on the host.

Cregedit

Regedit allows manual navigation of registry keys but requires knowing which keys to examine and cannot automatically enumerate all the dozens of ASEP locations that Autoruns covers.

DautorunsCorrect

Autoruns, part of the Microsoft Sysinternals Suite, comprehensively enumerates every location where software can configure itself to launch automatically - including registry run keys, scheduled tasks, services, browser extensions, boot execute entries, and many more. This makes it the definitive tool for incident handlers hunting persistence mechanisms on a Windows system.

Concept tested: Enumerating Windows autostart extensibility points with Autoruns

Source: https://learn.microsoft.com/en-us/sysinternals/downloads/autoruns

Topics

#autoruns#ASEP#Sysinternals#persistence enumeration

Community Discussion

No community discussion yet for this question.

Full GCIH Practice