After establishing a shell on a target system, Joe, a penetration tester is aware that his actions have not been detected. He now wants to maintain persistent access to the machine. Which of the…

A zero-day exploit by definition has no existing detection signatures or behavioral baselines, making it the least likely method to trigger an alert in security monitoring tools.

Creating a new domain user is auditable through Active Directory logs, but in large environments new accounts can blend in and may not be reviewed as quickly as a direct change to a monitored service.

Altering a known boot-time service creates highly visible artifacts in the Windows Service Control Manager, system event logs (Event ID 7045 and similar), and any file integrity monitoring solution watching service binaries and configuration. Most SIEM platforms and EDR tools have default rules specifically alerting on service modifications, making this change detectable almost immediately upon execution or the next system review.

Obtaining cleartext credentials is a passive, read-only action that leaves minimal forensic artifacts and is far less likely to generate an automated security alert than modifying a service configuration.