Lion Cipher Lab
Find every way a sample survives reboot: Run keys, services, tasks, startup, and WMI
- Digital Forensics & IR (DFIR)
- Intermediate
- ~50 min
- Free · no account required
Why it matters
The single most common way an incident goes from 'contained' back to 'on fire' is an incomplete cleanup: the responder finds the obvious Run key, deletes it, reimages nothing, and the machine re-infects on the next reboot because the same sample also dropped an auto-start service, a scheduled task, and a WMI subscription the responder never looked for. Real malware does not pick one persistence mechanism — it plants several redundant ones precisely so that killing one leaves the rest. The professional skill this drill builds is enumeration discipline: knowing the full menu of places Windows…
What you'll learn
- enumerating ALL Windows auto-start extensibility points (ASEPs) from one Autoruns-style view
- reading a Run key, an auto-start service, a scheduled task, a Startup-folder shortcut, and a WMI subscription as persistence
- recognizing an Image File Execution Options / accessibility 'hijack' entry
- mapping each anchor to its MITRE ATT&CK technique (T1547.001, T1543.003, T1053.005, T1546.003, T1546.012)
- understanding redundant persistence: why removing one anchor leaves the sample alive
- judgment: when an Autoruns sweep finds everything vs when a stealthy anchor (WMI) needs memory/forensics
- verifying complete removal instead of declaring victory after the first find
Steps in this lab
- The scenario, and why one anchor is never the whole story
- The master artifact — one consolidated Autoruns-style sweep
- Anchor #1 & #2 — the Run keys (HKCU and HKLM)
- Anchor #3 — the Startup-folder shortcut
- Anchor #4 — the malicious auto-start service
- Anchor #5 — the scheduled task
- Anchor #6 — the WMI event subscription (the stealthy one)
- Bonus anchor — the Image File Execution Options / accessibility hijack
- Why removing one anchor fails — count them, then cut them all
- The third rule: WHEN a sweep finds it all, and when it can't
- What you actually learned