Windows persistence collapses to a few places: audit first, then diff
The scenario is fictional. Commands and event IDs come from the book and aren't tested here; use a test environment first. Detection only. On Linux we audited keys and cron. Windows follows the same logic. Remember one line from part…