What is the primary goal of the ‘Persistence’ tactic [TA0003] in a cyber attack?
To maintain access to a compromised system across reboots and other interruptions.
Adversaries use persistence because they may not be able to reliably regain a foothold via their _____.
initial access technique
The persistence technique involving ‘Registry Run Keys & Startup Folder’ is identified by which MITRE ATT&CK ID?
T1547.001
The persistence technique involving ‘Logon Scripts’ is identified by which MITRE ATT&CK ID?
T1037.001
The persistence technique involving the ‘PowerShell Profile’ is identified by which MITRE ATT&CK ID?
T1546.013
The persistence technique involving ‘Scheduled Tasks’ is identified by which MITRE ATT&CK ID?
T1053.005
The persistence technique involving ‘Component Object Model Hijacking’ is identified by which MITRE ATT&CK ID?
T1546.015
The collection of techniques where an adversary configures a computer to automatically execute a payload during startup or logon is known as _____.
Boot or Logon Autostart Execution [T1547]
Which Windows Registry key allows a program to run every time a user logs in and remains after execution?
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Which Windows Registry key allows a program to run once when a user logs in and is then automatically deleted?
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce
What is the syntax of the reg_set command used to create a registry value?
reg_set <host:optional> <hive> <key> <value> <type> <data></data></type></value></key></hive></host:optional>
In the example reg_set HKCU ... Updater REG_EXPAND_SZ ..., what does ‘Updater’ represent?
The name of the new registry value being created.
Which command is used to read back a registry key’s value to confirm it was set correctly?
reg_query
Which command is used to remove a registry key or value when it’s no longer required?
reg_delete
What is the full path to the user’s Startup folder, which can be used for persistence?
%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup
How does an adversary establish persistence using the Startup folder?
By uploading or placing an executable file into the directory.
Which registry key contains a user’s environment variables and can be abused for logon script persistence?
HKCU\Environment
An adversary can set the _____ value in the HKCU\Environment key to point to a program that will execute on logon.
UserInitMprLogonScript
What is the name of the PowerShell script that executes when new PowerShell windows are opened by a user?
profile.ps1
What is a legitimate use for a PowerShell profile?
To customize the appearance and behavior of PowerShell sessions.
What is the example path given for a user’s PowerShell profile?
$HOME\Documents\WindowsPowerShell\Profile.ps1
Why is it important for an adversary to avoid putting blocking code directly into a PowerShell profile?
Because the user will not be presented with an input prompt until the profile script has finished executing.
Which PowerShell cmdlet can be used as a workaround to execute a payload from a profile without blocking the user’s prompt?
Start-Job
What is a common trigger for a legitimate scheduled task?
A specific time, computer idle, system start, user logon, or a system event.
-
Module 144
-
Module 243
-
Module 360
-
Module 466
-
Module 550
-
Module 660
-
Module 762
-
Module 856
-
Module 918
-
Module 1052
-
Module 1153
-
Module 1250
-
Module 1336
-
Module 1441
-
Module 1567
-
Module 1653
-
Module 1728
-
Module 1851
-
Module 1954
-
Module 2022
-
Cobalt Strike User Guide161
-
Cobalt Strike Installation Guide37
