Back After Boot
Difficulty: easy
Topics: T1547.001 - Registry Run Keys / Startup Folder
Problem statement
Scenario: A detection engineer is analyzing activity from an endpoint where a suspicious program briefly modified the Windows Registry during execution
The change appeared to influence user-level startup behavior but was quickly reverted, leaving little to no persistent evidence behind
No traditional persistence mechanisms such as services, scheduled tasks, or startup folder artifacts were found
However, telemetry indicates that the program interacted with the Registry through a Shell utility interface commonly used by Windows applications to store configuration settings and update Registry values, rather than performing direct Registry manipulation
The application uses narrow-character strings when interacting with the Windows API, providing an additional clue about which API variant is being used
Your task is to determine which Win32 API best matches this behavior, instrument it, and recover the hidden flag from its runtime parameters
OBJECTIVES: Research Registry Run Keys / Startup Folder (MITRE ATT&CK T1547.001) and understand how Windows applications programmatically establish user-level persistence through the Registry
Investigate how Windows applications create and modify registry values during runtime, and identify the system interfaces responsible for performing these operations
Develop runtime instrumentation to observe registry modification activity and capture the parameters associated with value creation or updates
Analyze the collected telemetry to determine how the application influences execution behavior through registry interactions
Recover all hidden flags by identifying the correct Win32 API and extracting the relevant runtime data exposed through its parameters.
How to solve this challenge
Open the in-browser IDE on this page, write your solution in C or C++, and click Run. A sandboxed agent compiles your code and executes it against the target while streaming live stdout, stderr, hook traces, and verification results over a WebSocket. When your implementation succeeds, the flag is surfaced automatically.
Who is this challenge for?
Detection engineers, blue team analysts, malware researchers, security engineers, and operators who want hands-on practice with T1547.001 - Registry Run Keys / Startup Folder.