Which specific Windows Registry key is most commonly targeted by malware to ensure persistence by executing a program automatically when a user logs in?

What is the primary legal purpose of maintaining a "Chain of Custody" during a cyber investigation?

In the Windows processor architecture, which "Ring" level represents Kernel Mode, where the core OS has unrestricted access to hardware?

Which directory in Linux is a "pseudo-filesystem" generated by the kernel to provide a direct view of running processes and hardware info?

Which Windows Security Event ID corresponds to "Process Creation," providing a log of every program started on the system?

If a Linux process is running from a malicious binary that has been deleted from the disk, what will the symbolic link `/proc/[pid]/exe` display?

Which NTFS feature allows a file entry to point to multiple streams of data, effectively allowing attackers to hide payloads behind a legitimate text file?

According to the "Order of Volatility," which data source must be collected first because it is the most temporary and disappears when power is lost?

Which Windows Registry artifact tracks the GUI applications launched by a user and obfuscates the names using ROT-13 encoding?

Which Linux command is used to identify binaries that have the SUID (Set User ID) permission bit set, which can be exploited for privilege escalation?

In the Windows "Sticky Keys" exploit, attackers modify the "Image File Execution Options" (IFEO) registry key to launch a command prompt. Which executable is the target of this modification?

Which Linux log file is the primary location for recording successful and failed login attempts, as well as `sudo` execution?

What is the specific term for the data of a very small file (typically under ~700 bytes) that is stored directly within the Master File Table (MFT) record itself?

Which technique involves an attacker starting a legitimate Windows process (like `svchost.exe`) in a suspended state, removing its code, and writing malicious code into the empty memory space?

Which Loadable Kernel Module (LKM) is the standard tool for dumping physical memory (RAM) from a Linux system?

Which Sysinternals tool allows a Windows analyst to view the parent-child relationships of processes and verify the digital signatures of running binaries?

In the Linux Audit system (auditd), which field tracks the original user ID of a person, ensuring accountability even after they escalate privileges using `sudo`?

Which command is used to set the "Immutable" bit (+i) on a Linux file, preventing even the root user from deleting or modifying it?

When analyzing memory for "fileless" malware, analysts look for memory pages with which suspicious permission combination?

Which Windows Registry key is used to track the window size and position of folders viewed in Windows Explorer, effectively proving a user navigated to a specific directory?

Which environment variable can an attacker use in Linux to force the dynamic linker to load a malicious shared library before legitimate system libraries?

Which specific Linux timestamp is the most difficult for attackers to forge because it is updated by the kernel whenever inode metadata changes?

In a compromised Linux web server, which file ownership anomaly would strongly suggest a web shell was uploaded via the application?

Which Linux command is specifically used to find "unlinked" files (files that have been deleted but are still held open by a running process)?