Certified Ethical Hacker (CEH) Practice Question

Placing the backdoor's executable path under the registry value HKLM\Software\Microsoft\Windows\CurrentVersion\Run creates an autostart entry that Windows triggers for every interactive logon, regardless of which account signs in. The entry is stored in a location that survives reboots and requires no additional services or binary replacement, so access is regained each session with minimal system modification.

Replacing sethc.exe with cmd.exe only yields an on-demand shell when Sticky Keys is invoked at the logon screen and is more conspicuous. A scheduled task can provide similar startup persistence but is easier to enumerate and may reveal the attacker's intent in the Task Scheduler UI. Installing a user-mode rootkit that hooks the SSDT offers concealment but is unnecessary for simple logon persistence and risks system instability.