Three kinds of persistence from one macro on NW-HR01 Start this lab

Why this matters

One macro, three footholds. Analysts routinely find the loudest persistence — the running process — and stop. This case grades whether you enumerated all of the Windows autostart surfaces before you called it contained.

Concepts

Objectives graded

• Work a Windows 11 workstation with cmd.exe: reg query, sc query, schtasks, tasklist, netstat
• Prove all three persistence mechanisms and the live outbound session
• Contain the host and the user identity under approval, then record the evidence trail

MITRE ATT&CK coverage

A macro-enabled attachment launches hidden PowerShell on an HR workstation, which establishes three parallel persistence footholds — a Run key, a Windows service and a scheduled task — all pointing at unsigned binaries.

What each rubric rule proves

• The workflow reached a terminal success state on the graded run.

  behavior · weight 20 · T1204.002 User Execution: Malicious File (Execution)

• A consequential action passed through a human approval gate.

  safety · weight 15 · T1204.002 User Execution: Malicious File (Execution)

• No non-idempotent operation was retried without an idempotency key.

  efficiency · weight 10 · T1071.001 Application Layer Protocol: Web Protocols (Command and Control)

• Every action node resolves its secret from the vault, never an inline field.

  configuration · weight 10 · T1053.005 Scheduled Task/Job: Scheduled Task (Persistence)

• The learner attached at least one linkable piece of evidence to the case.

  investigation · weight 10 · T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder (Persistence)

• The case carries an analyst closure note explaining the outcome.

  explanation · weight 10 · T1204.002 User Execution: Malicious File (Execution)

• No innocent asset in the alert batch was contained, disabled or revoked.

  behavior · weight 15 · T1053.005 Scheduled Task/Job: Scheduled Task (Persistence)

• The playbook survived the integration faults it met and still finished.

  configuration · weight 15 · T1071.001 Application Layer Protocol: Web Protocols (Command and Control)

• Nothing was changed in the estate before evidence had been gathered.

  investigation · weight 10 · T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder (Persistence)

• The analyst worked the workstation directly instead of grading the alert text.

  investigation · weight 10 · T1204.002 User Execution: Malicious File (Execution)

• The Run key persistence was found in the user hive, not assumed.

  investigation · weight 10 · T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder (Persistence)

• The installed service was identified, so eradication covers the SYSTEM-level foothold.

  investigation · weight 10 · T1543.003 Create or Modify System Process: Windows Service (Persistence)

• The external peer was proven from the host's own socket table.

  investigation · weight 10 · T1071.001 Application Layer Protocol: Web Protocols (Command and Control)

• The live beacon was identified by PID before anything was contained.

  behavior · weight 10 · T1071.001 Application Layer Protocol: Web Protocols (Command and Control)

• The scheduled task that re-arms the implant was found, so eradication outlives a reboot.

  behavior · weight 10 · T1053.005 Scheduled Task/Job: Scheduled Task (Persistence)

• The compromised workstation is isolated at end state.

  behavior · weight 15 · T1204.002 User Execution: Malicious File (Execution)

• The user identity that executed the macro is disabled pending credential reset.

  behavior · weight 10 · T1078 Valid Accounts (Defense Evasion)

• The analyst can name the Windows event that records service installation.

  explanation · weight 10 · T1543.003 Create or Modify System Process: Windows Service (Persistence)

• A post-incident timeline was filed: macro, hidden PowerShell, Run key, service, task, containment.

  explanation · weight 15 · T1204.002 User Execution: Malicious File (Execution)

• The analyst scoped the host's network from the wire, so containment decisions know which segment is in play.

  investigation · weight 5

• The analyst scoped the machine itself, so memory-hungry triage steps are planned against real capacity rather than a guess.

  investigation · weight 3

• Disk capacity was taken from the volume itself, which is what makes an image or memory-dump decision defensible.

  investigation · weight 3

Common mistakes

• Stopping at the Run key and missing the service and the scheduled task.
• Filing the binary path where the finding asks for the value or service name.
• Trusting the service display name instead of checking the ImagePath.
• Isolating the print server, which answered a routine print logon.

Same idea, three vendors

Vocabulary is generated from the teaching profiles, so it always matches what the consoles render.

The same concepts in shipping products

The consoles you practice in use teaching names. These are the words the real vendors print in their own documentation, so the vocabulary survives the day you sit in front of a production tenant.