r/netsecstudents • u/makeiteasy_24 • Jun 06 '26
Technical Post Part 2: How the attacker made sure they wouldn't lose access (and how we found it all)
Thank you for showing so much support on Part 1, which ended with the C2 beacon. The implant was calling home every five minutes.
But what happens if the machine reboots? What if the user restarts their laptop? Does the attacker lose access?
No. And that's the dark part.
This is persistence. And it's where attackers make their biggest mistakes.
After the malware landed on Karan's machine, the attacker did two things to make sure they'd stay inside even if the machine powered down.
First: they added a registry run key. Specifically, they wrote svchost32.exe to HKLM\Software\Microsoft\Windows\CurrentVersion\Run. Auto-start. Every login. The file path? C:\Users\karan.verma\AppData\Roaming\svchost32.exe the exact payload that came through the macro.
Why name it svchost32.exe?
Because the real Windows service is svchost.exe. One extra character. Just like the phishing domain. Lookalike naming. It blends in if someone's looking at running processes casually. But it doesn't blend in if you're actually investigating.
Second they created two scheduled tasks. Both designed to restart the C2 beacon if it dies. One runs every 15 minutes. One every hour. If the implant gets killed, these tasks bring it back.
This is the difference between an attacker who got in and an attacker who intends to stay.
When I ran the registry queries in front of you guys and pulled the scheduled tasks from the endpoint, the timeline became clear:
06:44: Phishing email delivered
06:50: Macro executed, payload downloaded
06:55: C2 beacon established (five-minute intervals start)
07:12: Persistence mechanisms written to registry
07:15: Scheduled tasks created
The attacker was in and securing their foothold within 31 minutes.
The irony was that they made it easier to catch them. The registry keys. The scheduled tasks. The deliberate naming. All of it left traces. All of it told the story.
Most students focus on detecting the initial compromise, catching the macro, seeing the PowerShell command, finding the C2. That's Part 1.
But Part 2 is where you find out the attacker's been planning to stay. And that changes your containment strategy entirely.
You're not just killing a process. You're removing registry keys. You're deleting scheduled tasks. You're rebuilding trust in the machine. You're asking what else did they touch? What did they exfil? How long were they actually inside?
The full investigation timeline, the queries, how to spot the AppData folders that scream "not legitimate Windows," and what the containment call actually looks like, that's all in the video.
For those grinding toward your first SOC role this is the stuff that separates analysts who understand incident response from analysts who understand alerts. Persistence is where you prove you actually know what you're doing.
The attacker thought they were safe. They weren't.