nerdexam
GIAC

GCIH · Question #746

Which of the following persistence techniques will be identified using the Autoruns utility?

The correct answer is B. Scheduled tasks. Autoruns by Sysinternals displays programs and tasks configured to run automatically at startup or login, making scheduled tasks directly visible and auditable.

Vulnerability Exploitation & Privilege Escalation

Question

Which of the following persistence techniques will be identified using the Autoruns utility?

Options

  • AWeb Shells
  • BScheduled tasks
  • CAccount creation
  • DSSH key modification

How the community answered

(19 responses)
  • A
    5% (1)
  • B
    95% (18)

Why each option

Autoruns by Sysinternals displays programs and tasks configured to run automatically at startup or login, making scheduled tasks directly visible and auditable.

AWeb Shells

Web shells are files placed on a web server and executed through HTTP requests; they are not registered in any auto-start location that Autoruns monitors.

BScheduled tasksCorrect

Autoruns enumerates all auto-start locations on a Windows system, including the Task Scheduler, registry run keys, startup folders, and services. Scheduled tasks appear under the 'Scheduled Tasks' tab, making them easy to identify as a persistence mechanism planted by an attacker.

CAccount creation

Account creation establishes a new local or domain user account and does not create an auto-start entry, so it does not appear in Autoruns output.

DSSH key modification

SSH key modification adds keys to ~/.ssh/authorized_keys files on Unix-like systems, which are not Windows auto-start registry or task locations tracked by Autoruns.

Concept tested: Windows persistence detection using Autoruns utility

Source: https://learn.microsoft.com/en-us/sysinternals/downloads/autoruns

Topics

#persistence mechanisms#Autoruns#scheduled tasks#Windows persistence

Community Discussion

No community discussion yet for this question.

Full GCIH Practice