A Windows system has been compromised. An attacker added a registry value under HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options for 'sethc.exe' pointing to cmd.exe. What persistence and access technique does this implement?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because setting IFEO (Image File Execution Options) Debugger for sethc.exe (Sticky Keys) to cmd.exe causes a SYSTEM-level command prompt to appear when Shift is pressed 5 times on the login screen, bypassing authentication — a classic backdoor technique. A is wrong because this is not a scheduled task; it is an application execution hijacking using IFEO.
Full explanation below image
Full Explanation
B is correct because setting IFEO (Image File Execution Options) Debugger for sethc.exe (Sticky Keys) to cmd.exe causes a SYSTEM-level command prompt to appear when Shift is pressed 5 times on the login screen, bypassing authentication — a classic backdoor technique. A is wrong because this is not a scheduled task; it is an application execution hijacking using IFEO. C is wrong because IFEO affects process execution, not browser extensions. D is wrong because this technique does not involve kernel driver installation; it operates at the application execution layer.