Exam 312-49v10 topic 1 question 793 discussion

C. Windows AutoStart Registry Keys Explanation: Fileless malware often leverages Windows AutoStart registry keys (such as those found in HKCU\Software\Microsoft\Windows\CurrentVersion\Run or HKLM\Software\Microsoft\Windows\CurrentVersion\Run) to achieve persistence. By creating or modifying entries in these registry keys, the malware can ensure that it executes each time the system starts, even if the original file-based components are not present.

B. Windows Task Scheduler Explanation: Windows Task Scheduler: Persistence Mechanism: Attackers often use Windows Task Scheduler to create tasks that run on system startup or at scheduled intervals. This allows the malware to execute even after a reboot, making it a common method for maintaining persistence in fileless malware attacks. Windows AutoStart Registry Keys: Potential for Persistence: While AutoStart registry keys (such as those under HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run) are indeed used for persistence, fileless malware often avoids traditional file-based mechanisms and may prefer leveraging scheduled tasks due to their ability to execute code directly from memory.

Registry is most used

Using task scheduler, attackers can set the malicious scripts to be triggered and executed automatically at a chosen time intervals.