Persistence on a permitting workstation is created with a Windows Run key. In this blueprint, what does registry mean?
Select an answer to reveal the explanation.
Short Explanation
Registry here is the Windows hive on that permitting PC—the place attackers stash a Run key so they come back after reboot. It is not the city's domain registrar and not the notable-status queue. Think host artifact, not DNS paperwork.
Full Explanation
On the SPLK-5001 blueprint, registry refers to the Windows configuration database used for persistence and forensic artifacts, such as a Run key on a civic workstation. It is not a DNS domain registrar, an Enterprise Security workflow state, or the Asset and Identity lookup. Analysts should inspect host registry artifacts when the term appears in this context.