Hello everyone. Has anyone been able to complete this? Hunt 2 : Create a KQL query to hunt for “Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder”. Enter the content of the registry.value field in the document that is related to the first registry-based persistence action as your answer.
I have searched for the event.code it mentions in the hint and tried to create several queries looking for registry modification or the start up folder being ran. Any help would be super helpful.
Hi there, just figured out the answer.
Pay close attention to the process executable value, besides the event code.
There is only one right hit.
Good luck.
A program has been added to the registry based folder for Autostart to ensure persistence
Hunt for the content in the first registry based document
Thought Process
Create a EVENT.CODE 13 and a filter for the registry.path using “Run” as my filter as I am on the look out for Registy Run Key ( event.code: 13 AND registry.value * Run*, if it was the Start Up folder, it would have been *Start *)
Add registry.value as field as well as the registry.path
Hi all, just have a general query
i have solved the questions, mostly with help from this forum and also some luck.
Would that be good enough to clear the exam?
just got it by usinge search (use star to search all values) and filter with as HKU and use as column. you will get few hundreds of hits, just keep filtering out all the hits that happened more than once so you left with around 10 - 20, answer will be in those hits, just try one at a time and you will get it. Good luck
I’m not quite sure how I got the answer, it became a bit trial-and-error come my final query. Tips for anyone stuck; Use the hint; Because we are looking for registry run keys, filter the registry path to include Run (do not use “”, or spaces, caps also matter); Good Luck all!
)
