Research

Guided lab: find the Run key before it finds you

A first investigation for anyone who has read about persistence but never gone looking for it. You will plant a Run key with Atomic Red Team, then find it three different ways and work out which of the three you would actually trust in production.

Run key persistence: what the registry alone will not tell you

A lab reconstruction of a user-level persistence case, and why the Run key timestamp is the least useful thing in the artifact set.

Full write-up available to members subscribers. See what is included.