Lab 5: Persistence Laboratory
Detect and analyse simulated persistence mechanisms in a prepared virtual machine, without deploying real persistence.
The brief
Detect and analyse the simulated persistence mechanisms planted in a prepared virtual machine, and explain how each survives a reboot.
Getting in once is not the same as staying in. This lab is about persistence: the strategies malware uses to survive a reboot or an interruption, and why removing an established piece of malware is routinely harder than finding it in the first place.
Rather than build any real persistence mechanism, students are handed a prepared virtual machine with several already planted, and the task is detection and analysis: find each one, and explain in concrete terms how it survives the events that would otherwise remove it.
What you submit
- A list of persistence mechanisms found in the prepared VM
- An explanation of how each mechanism survives interruption or reboot
Due: 31 August 2027 ·Weight: 2% of the course grade
How it is marked
Assessed on whether the analysis correctly identifies each planted persistence mechanism and explains how it survives interruption.
Key dates
- Submission due: 31 August 2027
The spec
The brief poses the problem and leaves room for a response. The spec is the fixed part: what a marker checks. Some lines can be checked mechanically; the rest call for judgement.
- submitted by the deadline, in the format named below
- each persistence mechanism found is explained, not just listed
- accounts for the persistence mechanisms planted in the prepared virtual machine
- explains in mechanism-specific terms how each one survives a reboot or interruption
- reflects why an established mechanism is harder to remove than it was to find, rather than treating detection and removal as one problem