nerdexam
GIAC

GCIH · Question #812

What is an incident handler looking for when executing the PowerShell command below? Get-ItemProperty 'HKLM:Software\Microsoft\Windows\CurrentVersion\Run'

The correct answer is A. Programs that load automatically when the system starts. The Windows Run registry key is a well-known persistence location that incident handlers inspect to identify programs configured to launch automatically at system startup.

Incident Response & Cyber Kill Chain

Question

What is an incident handler looking for when executing the PowerShell command below? Get-ItemProperty 'HKLM:Software\Microsoft\Windows\CurrentVersion\Run'

Options

  • APrograms that load automatically when the system starts
  • BAll applications that are currently running on the system
  • CList of installed software that are available to be executed
  • DThe version numbers of software installed on the system

How the community answered

(25 responses)
  • A
    88% (22)
  • B
    4% (1)
  • C
    8% (2)

Why each option

The Windows Run registry key is a well-known persistence location that incident handlers inspect to identify programs configured to launch automatically at system startup.

APrograms that load automatically when the system startsCorrect

HKLM:\Software\Microsoft\Windows\CurrentVersion\Run is one of the primary autostart extension points (ASEPs) in Windows, where values are executed every time the system boots before user login. Malware commonly abuses this key to establish persistence, so Get-ItemProperty on this path is a standard triage step to detect unauthorized or malicious startup entries. Incident handlers compare the results against known-good baselines to identify suspicious executables.

BAll applications that are currently running on the system

Currently running processes are enumerated with cmdlets like Get-Process or via Task Manager and WMI, not by reading a static registry key.

CList of installed software that are available to be executed

Installed software inventory is found under HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall, not the Run key.

DThe version numbers of software installed on the system

Software version numbers are stored in application-specific subkeys or the Uninstall hive, not in the Run autostart key.

Concept tested: Windows Run key persistence and autostart enumeration

Source: https://learn.microsoft.com/en-us/windows/win32/setupapi/run-and-runonce-registry-keys

Topics

#registry run key#persistence#autostart programs#PowerShell forensics

Community Discussion

No community discussion yet for this question.

Full GCIH Practice