Plant five persistence mechanisms and find all five

short · 60 min · Objective 3.3

Task

Install five different persistence mechanisms on your lab hosts, wait, then hunt them all down from a clean enumeration. The exercise is finding the fifth, because partial eradication looks exactly like complete eradication.

Steps

  1. On the Windows VM, plant three, each launching notepad.exe or an equivalent harmless program: a Run key, a scheduled task, and a service. Give them plausible names, not obvious ones.
  2. On the Linux VM, plant two: a cron entry and a systemd timer, both running /bin/true.
  3. Write the five down, seal the note, and leave it a day.
  4. Come back and enumerate persistence systematically on both hosts, by category, comparing against your clean snapshot rather than judging by eye. Do not consult the note.
  5. Now practise the containment order: for the Windows VM, decide which containment you would use and why -- EDR isolation, switch port, power off -- given that you still want memory.
  6. Remove everything you found, then re-enumerate and confirm the host is clean.
  7. Open the note. If you missed one, work out what category of enumeration you did not perform.

Verify

powershell -c "Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' | Format-List"
powershell -c "(Get-ScheduledTask | Where-Object {$_.Author -notmatch 'Microsoft'}).TaskName"
powershell -c "(Get-Service | Where-Object {$_.Name -notmatch '^(W32|Win|Net|Sys)'}).Name | Measure-Object | Select-Object -Expand Count"
crontab -l 2>/dev/null | grep -vc "^#"
systemctl list-timers --all --no-pager | grep -c "\.timer"

After removal, the Run key must not contain your entry, the task list must not contain your task, and the cron count must be back to its baseline. The point of running these before removal as well is that you need the baseline: a count with nothing to compare it to tells you nothing about whether it is normal.

Notes

Compare against the clean snapshot, not against your judgement of what looks normal. "Is this service supposed to be here" is unanswerable by inspection on an unfamiliar host, which is why a baseline is worth more than expertise here.

If you found four of five, that is the lesson. The intrusion would have come back, the alerts would have stopped in the meantime, and the incident would have been closed as resolved.

This is an independent study companion for CompTIA CySA+ CS0-004 and is not produced by or endorsed by CompTIA.