Exam PT0-003 Topic 1 Question 114 Discussion

The logs indicate that the penetration testing team's objective was to create persistence in the network.
Explanation:
* Log Analysis:
* schtasks /query: This command lists all the scheduled tasks on the system. It is often used to understand what tasks are currently scheduled and running.
* schtasks /CREATE /SC DAILY: This command creates a new scheduled task that runs daily.
Creating such a task can be used to ensure that a script or program runs regularly, maintaining a foothold in the system.
* Persistence:
* Definition: Persistence refers to techniques used to maintain access to a compromised system even after reboots or other interruptions.
* Scheduled Tasks: One common method of achieving persistence on Windows systems is by creating scheduled tasks that execute malicious payloads or scripts at regular intervals.
* Other Options:
* Enumerate Current Users: The logs do not show commands related to user enumeration.
* Determine Users' Permissions: Commands like whoami or net user would be more relevant for checking user permissions.
* View Scheduled Processes: While schtasks /query can view scheduled tasks, the addition of the schtasks /CREATE command indicates the intent to create new scheduled tasks, which aligns with creating persistence.
Pentest References:
* Post-Exploitation: Establishing persistence is a key objective after gaining initial access to ensure continued access.
* Scheduled Tasks: Utilizing Windows Task Scheduler to run scripts or programs automatically at specified times as a method for maintaining access.
By creating scheduled tasks, the penetration testing team aims to establish persistence, ensuring they can retain access to the system over time.