Few persistence mechanisms are as deceptively simple as Registry Run Keys, a handful of registry values that tell Windows what to execute at logon or startup.

Attackers have relied on them for decades precisely because they are easy to plant, hard to spot among legitimate entries, and survive reboots without any additional effort. In this room, you will approach the topic from a DFIR perspective, learning how to identify, analyze, and validate Run Key-based persistence during real-world investigations. 

Learning Objectives

This room focuses on:

• Understanding how Windows Run Keys are used for persistence.
• Identifying suspicious and malicious Run Key entries.
• Detecting Run Key abuse using Windows Event Logs and Sysmon.
• Learning DFIR workflows for investigating AutoStart persistence mechanisms.
• Practicing the analysis of Run Key persistence in real-world scenarios.

Prerequisites

Before starting this room, you should be familiar with:

• Basic Windows internals
• Windows Registry structure
• Windows Event Logs and Sysmon
• Fundamental Incident Response concepts
• Previous Windows IR-focused rooms

Machine Access

Launch DefenseBox by clicking Start DefenseBox and use this machine for practical exercises. You can also connect over OpenVPN and RDP using the credentials below.

Set up your virtual environment

To successfully complete this room, you'll need to set up your virtual environment. This involves starting the DefenseBox, ensuring you're equipped with the necessary tools and access to tackle the challenges ahead.

Defender machine

Status:Off