What is the primary purpose of adding a round of ‘elevated persistence’ after gaining initial privileged access?
To ensure that a high level of privilege can be maintained, even if the initial elevation method is patched or detected.
According to the source, what are two specific techniques for achieving elevated persistence on Windows?
Scheduled Tasks and Windows Services.
Why would an adversary use an elevated persistence method if their initial elevation method is considered ‘loud’?
To avoid performing the noisy initial elevation method multiple times, which could lead to detection.
The Windows Task Scheduler can be used to execute payloads as which high-privilege account to maintain access?
SYSTEM (or NT AUTHORITY\SYSTEM).
In the provided XML for a scheduled task, what does the <BootTrigger> element define?
It specifies that the task will be executed when the computer boots up.
Within the scheduled task’s XML, what does the <UserId>NT AUTHORITY\SYSTEM</UserId> tag specify?
It sets the user context for the task to run as the SYSTEM account.
In the task’s XML principals, what is the function of the <RunLevel>HighestAvailable</RunLevel> setting?
It ensures the task runs with the highest possible privileges available to the specified user.
What is the purpose of the <Hidden>true</Hidden> setting within the scheduled task’s XML definition?
To hide the task from the normal Task Scheduler user interface, making it harder to discover.
In the scheduled task example, which XML element contains the command to be executed?
The <Exec> element.
What is the full path to the executable that the sample scheduled task is configured to run?
C:\Windows\System32\beacon_x64.exe
An adversary uses the command schtaskscreate \Beacon XML CREATE to create a new task. What does the XML argument signify?
It indicates that the task’s configuration is being provided from an XML file.
Besides scheduled tasks, an adversary can create a _____ to run a payload under the SYSTEM context when the computer boots.
Windows service
What command is used in the example to create a new Windows service named ‘dbgsvc’?
sc_create
In the sc_create command sc_create dbgsvc "Debug Service" C:\Windows\System32\debug_svc.exe ..., what does the binpath parameter specify?
It specifies the path to the service’s executable file (C:\Windows\System32\debug_svc.exe).
What command is recommended to verify that a Windows service was created successfully?
sc_qc
In the output of sc_qc dbgsvc, what does START_TYPE : 2 AUTO_START indicate?
It indicates that the service is configured to start automatically when the operating system boots.
The sc_qc output shows SERVICE_START_NAME : LocalSystem. What is this equivalent to?
The SYSTEM account (NT AUTHORITY\SYSTEM).
In the sc_qc output for dbgsvc, what does ERROR_CONTROL : 0 IGNORE mean?
It means if the service fails to start, the startup process will not be notified and will continue without logging an error.
-
Module 144
-
Module 243
-
Module 360
-
Module 466
-
Module 550
-
Module 660
-
Module 762
-
Module 856
-
Module 918
-
Module 1052
-
Module 1153
-
Module 1250
-
Module 1336
-
Module 1441
-
Module 1567
-
Module 1653
-
Module 1728
-
Module 1851
-
Module 1954
-
Module 2022
-
Cobalt Strike User Guide161
-
Cobalt Strike Installation Guide37
