GCIH · Question #746
Which of the following persistence techniques will be identified using the Autoruns utility?
The correct answer is B. Scheduled tasks. Autoruns by Sysinternals displays programs and tasks configured to run automatically at startup or login, making scheduled tasks directly visible and auditable.
Question
Which of the following persistence techniques will be identified using the Autoruns utility?
Options
- AWeb Shells
- BScheduled tasks
- CAccount creation
- DSSH key modification
How the community answered
(19 responses)- A5% (1)
- B95% (18)
Why each option
Autoruns by Sysinternals displays programs and tasks configured to run automatically at startup or login, making scheduled tasks directly visible and auditable.
Web shells are files placed on a web server and executed through HTTP requests; they are not registered in any auto-start location that Autoruns monitors.
Autoruns enumerates all auto-start locations on a Windows system, including the Task Scheduler, registry run keys, startup folders, and services. Scheduled tasks appear under the 'Scheduled Tasks' tab, making them easy to identify as a persistence mechanism planted by an attacker.
Account creation establishes a new local or domain user account and does not create an auto-start entry, so it does not appear in Autoruns output.
SSH key modification adds keys to ~/.ssh/authorized_keys files on Unix-like systems, which are not Windows auto-start registry or task locations tracked by Autoruns.
Concept tested: Windows persistence detection using Autoruns utility
Source: https://learn.microsoft.com/en-us/sysinternals/downloads/autoruns
Topics
Community Discussion
No community discussion yet for this question.