During a threat hunt, an analyst uses Velociraptor to collect forensic artifacts from endpoints. Which THREE of the following artifacts are most useful for detecting persistence mechanisms?

CS0-003 Security Operations Practice Question

Correct answer & explanation

✓

Scheduled tasks

Scheduled tasks, registry Run keys, and service configurations are common persistence locations monitored by attackers.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
List of installed updates
Why it's wrong here
An installed updates list, typically from Windows Update, WSUS, or a package manager, records patch history and does not contain any auto-start extension points. Updates alter system binaries and are scheduled by Windows Update services, but simply knowing a patch is installed does not reveal a persistence mechanism. Attackers may abuse update infrastructure or overwrite update binaries, but the list itself is not an execution artifact for threat hunting persistence. Therefore, while useful for vulnerability management, this collection is not relevant for identifying attacker persistence.
✓
Scheduled tasks
Why this is correct
Scheduled tasks are a native Windows mechanism that can trigger a binary or script when a user logs on, at system startup, or at regular intervals. Attackers routinely create named or hidden tasks to rerun malware or maintain command-and-control, and these tasks survive a reboot (unless disabled). Because the task description, action, triggers, and run-as user are all stored in the Task Scheduler database, examining it with Velociraptor can reveal suspicious persistence. This makes scheduled tasks an essential artifact in any threat hunt.
✗
ARP cache
Why it's wrong here
The ARP cache is a volatile protocol-level mapping between IPv4 addresses and MAC addresses for hosts on the local network, and it is populated dynamically as traffic is sent. It contains no executable code, no logon triggers, and no boot-time configuration, so it cannot serve as a persistence mechanism. While clearing or poisoning the ARP cache can aid in network attacks or pivoting, the cache contents themselves do not re-launch code after reboot. Thus, it is a red herring for identifying how malware maintains persistence.
✓
Service configuration
Why this is correct
Windows services are registered under the Service Control Manager and are configured to start automatically when the system boots, often under LocalSystem or another privileged account. An attacker can create a new service pointing to a malicious executable (e.g., via `sc create` or by writing to `HKLM\SYSTEM\CurrentControlSet\Services`) and set its start type to AUTO_START to gain persistence. Collecting service configurations enables an analyst to spot unusual image paths or services named to imitate legitimate software, making this artifact highly relevant for persistence detection.
✓
Registry Run keys
Why this is correct
Run keys such as `HKCU\Software\Microsoft\Windows\CurrentVersion\Run` and `HKLM\Software\Microsoft\Windows\CurrentVersion\Run` specify commands that automatically execute when a user logs into the system. Attackers frequently add malicious entry names and binary paths to these keys, and the effect is limited to logon, not boot (for HKCU) or applies to all users. Velociraptor can collect and parse these values to identify unexpected autostarts, making them a classic persistence artifact. The existence of a Run key is a strong indicator for persistence.

CS0-003 Security Operations Practice Question

Why each option matters

Option-by-option breakdown

Related to this question