A Windows system has been compromised. An attacker added a registry value under HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options for 'sethc.exe' pointing to cmd.exe. What persistence and access technique does this implement?
Select an answer to reveal the explanation.
Short Explanation
Here's the deal — this is an accessibility feature backdoor because replacing sethc.exe through IFEO gives you a SYSTEM-level command prompt when you press Shift five times at the login screen, without credentials. It's not a scheduled task, browser extension, or kernel driver; it hijacks application execution.
Full Explanation
The correct technique is an accessibility feature backdoor, a Sticky Keys replacement, because setting the Image File Execution Options Debugger for sethc.exe to cmd.exe causes a SYSTEM-level command prompt to appear when Shift is pressed five times on the Windows login screen, bypassing authentication. This is a classic backdoor technique that hijacks application execution rather than creating a normal startup mechanism. The scheduled task that runs cmd.exe at every system startup is wrong because this is not a scheduled task; it is application execution hijacking using IFEO. The browser extension that launches cmd.exe when the browser opens is wrong because IFEO affects process execution, not browser extensions. The kernel driver installation for rootkit persistence is wrong because this technique does not involve kernel driver installation; it operates at the application execution layer.