Registry Persistence Detection

Walkthrough summary

Registry Persistence Detection TryHackMe walkthrough with 17 answered prompts and lab methodology notes.

Sample prompts covered

• What is the value "Name" of the suspicious registry entry that runs during startup? Include the parenthesis.
  Open the walkthrough page to inspect the full answer and command flow.
• What is the value "Data" of the suspicious registry entry that runs during startup?
  Open the walkthrough page to inspect the full answer and command flow.
• What string is displayed on the console when the suspicious file runs?
  Open the walkthrough page to inspect the full answer and command flow.
• What AutoRun function is used for getting and displaying the auto-run entries?
  Open the walkthrough page to inspect the full answer and command flow.
• What AutoRun function is used for creating a baseline file from Autoruns artifact(s)?
  Open the walkthrough page to inspect the full answer and command flow.