GCIH · Question #812
What is an incident handler looking for when executing the PowerShell command below? Get-ItemProperty 'HKLM:Software\Microsoft\Windows\CurrentVersion\Run'
The correct answer is A. Programs that load automatically when the system starts. The Windows Run registry key is a well-known persistence location that incident handlers inspect to identify programs configured to launch automatically at system startup.
Question
What is an incident handler looking for when executing the PowerShell command below? Get-ItemProperty 'HKLM:Software\Microsoft\Windows\CurrentVersion\Run'
Options
- APrograms that load automatically when the system starts
- BAll applications that are currently running on the system
- CList of installed software that are available to be executed
- DThe version numbers of software installed on the system
How the community answered
(25 responses)- A88% (22)
- B4% (1)
- C8% (2)
Why each option
The Windows Run registry key is a well-known persistence location that incident handlers inspect to identify programs configured to launch automatically at system startup.
HKLM:\Software\Microsoft\Windows\CurrentVersion\Run is one of the primary autostart extension points (ASEPs) in Windows, where values are executed every time the system boots before user login. Malware commonly abuses this key to establish persistence, so Get-ItemProperty on this path is a standard triage step to detect unauthorized or malicious startup entries. Incident handlers compare the results against known-good baselines to identify suspicious executables.
Currently running processes are enumerated with cmdlets like Get-Process or via Task Manager and WMI, not by reading a static registry key.
Installed software inventory is found under HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall, not the Run key.
Software version numbers are stored in application-specific subkeys or the Uninstall hive, not in the Run autostart key.
Concept tested: Windows Run key persistence and autostart enumeration
Source: https://learn.microsoft.com/en-us/windows/win32/setupapi/run-and-runonce-registry-keys
Topics
Community Discussion
No community discussion yet for this question.