After establishing a shell on a target system, Joe, a penetration tester is aware that his actions have not been detected. He now wants to maintain persistent access to the machine. Which of the following methods would be MOST easily detected?
A) Run a zero-day exploit.
B) Create a new domain user with a known password.
C) Modify a known boot time service to instantiate a call back.
D) Obtain cleartext credentials of the compromised user.

Question

Quizplus · Accepted Answer

Modifying a known boot time service to instantiate a call back is the most easily detected method because it involves making changes to the system's configuration, which can be easily detected by security monitoring tools.

After Establishing a Shell on a Target System, Joe, a Penetration