An attacker uses the command reg add HKLM\SOFTWARE\Microsoft\Window…

Question

An attacker uses the command reg add HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon /v Userinit /d C:\Windows\system32\userinit.exe,C:\Users\Public\backdoor.exe. What persistence mechanism is being established?

Accepted Answer

The attacker is modifying the Winlogon Userinit value to launch a backdoor executable alongside the legitimate Userinit process on every user login — Here's the deal — b is correct because the Winlogon Userinit registry value specifies what processes run during user logon; appending a malicious executable to the comma-separated list causes it to launch with SYSTEM context on every user login, a well-known persistence technique. A is wrong because service installation uses different registry keys (HKLM\SYSTEM\CurrentControlSet\Services), not Winlogon.

Answer

The attacker is creating a Windows service for persistence

Answer

The attacker is enabling remote desktop access through the registry

Answer

The attacker is adding a scheduled task via registry modification

An attacker uses the command `reg add HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon /v Userinit /d C:\Windows\system32\userinit.exe,C:\Users\Public\backdoor.exe`. What persistence mechanism is being established?

Short Explanation and Infographic

Full Explanation