In this room, we focus on Windows Services as a persistence mechanism. Services are core OS components used legitimately by enterprise software, security tools, and administrators, but they are also frequently abused by attackers to establish persistent, elevated access that survives reboots and blends into normal system activity. Because services run in the background and are deeply integrated into the OS, malicious service-based persistence can go unnoticed for long periods, especially in large environments with hundreds of legitimate services.

This room is designed from a DFIR perspective. You will learn how to identify, analyze, and validate malicious service-based persistence in real-world investigations using event logs, forensic artifacts, and live-response techniques.

Learning Objectives

In this room, you will learn how to:

• Understand how Windows Services are used for persistence.
• Identify suspicious and malicious service configurations.
• Detect service-based persistence using Windows Event Logs and Sysmon.
• Learn DFIR workflows for investigating malicious services.
• Analyze service-related forensic artifacts during offline investigations.
• Practice investigating real-world service persistence scenarios.

Prerequisites

Before starting this room, you should be familiar with:

• Basic Windows internals
• Windows Services and Service Control Manager basics
• Windows Event Logs and Sysmon
• Fundamental incident response concepts
• Previous Windows IR-focused rooms

Launch DefenseBox by clicking Start DefenseBox and use this machine for practical exercises. You can also connect over OpenVPN and RDP using the credentials below.

Set up your virtual environment

To successfully complete this room, you'll need to set up your virtual environment. This involves starting the DefenseBox, ensuring you're equipped with the necessary tools and access to tackle the challenges ahead.

Defender machine

Status:Off