Back After Boot
Difficulty: easy
Topics: T1547.001 - Registry Run Keys / Startup Folder
Problem statement
A detection engineer is analyzing activity from an endpoint where a suspicious program briefly modified the Windows Registry during execution
The change appeared to influence user-level startup behavior but was quickly reverted, leaving little to no persistent evidence behind
No traditional persistence mechanisms such as services, scheduled tasks, or startup folder artifacts were found
However, telemetry indicates that the program interacted with the Registry through a Shell utility interface commonly used by Windows applications to store configuration settings and update Registry values, rather than performing direct Registry manipulation
Your task is to determine which Win32 API best matches this behavior, instrument it, and recover the hidden flag from its runtime parameters
OBJECTIVES: - Research Registry Run Keys / Startup Folder (MITRE ATT&CK T1547.001) and understand how Windows applications programmatically establish user-level persistence through the Registry. - Investigate how Windows applications create and modify registry values during runtime, and identify the system interfaces responsible for performing these operations. - Develop runtime instrumentation to observe registry modification activity and capture the parameters associated with value creation or updates. - Analyze the collected telemetry to determine how the application influences execution behavior through registry interactions. - Recover all hidden flags by identifying the correct Win32 API and extracting the relevant runtime data exposed through its parameters.
How to solve this challenge
Open the in-browser IDE on this page, write your solution in C or C++, and click Run. A sandboxed agent compiles your code and executes it against the target while streaming live stdout, stderr, hook traces, and verification results over a WebSocket. When your implementation succeeds, the flag is surfaced automatically.
Who is this challenge for?
Detection engineers, blue team analysts, malware researchers, security engineers, and operators who want hands-on practice with T1547.001 - Registry Run Keys / Startup Folder.