Follow the finding.
Inspect the evidence.

Review the 42-of-500 research result, documented public-image cases, and actual product findings. Follow each assessment to its supporting evidence and confidence limits.

Explore the platform

Pursuit · Agentic compromise investigation

Elastio research / 2026

42 of 500Public marketplace machine images
carried malicious persistence.

Elastio’s research identified malicious persistence in 42 of 500 public marketplace machine images. The result applies to the images analyzed. An image does not need to be running to retain the mechanisms an attacker could use.

Public Windows image / High confidence

A vulnerable driver configured to load, with offensive tools on disk.

The report records a DBUTIL auto-start service pointing to a vulnerable driver in the Administrator’s Downloads folder, historical execution of beacon_x64.exe, and a Cobalt Strike client still on disk.

The service, file, and execution records support the assessment. They do not by themselves establish who placed the tools there or whether the image was running at analysis time.

View report and artifact references

Report: persistence-ami-000672e12ac745f49
Analysis cited: June 2026
Recorded activity: May 5–9, 2025

Driver: DBUtil_2_3.sys
SHA-256: 0296e2ce999e67c76352613a718e11516fe1b0efc3ffdb8918fc999dd76a73a5

A second driver referenced by the UmPass service was missing. Its content was not validated in the supplied summary.

Public Windows image / High confidence

A scheduled task downloads files and sends them through email.

The AutoMailJob report connects an Administrator scheduled task to gdrive_mail.ps1. The supplied timeline records 29 runs and a transcript of a Google Drive download followed by an email through Gmail.

The script and recorded activity support the described transfer behavior. The historical records do not establish that the task is executing now.

View report and artifact references

Report: persistence-ami-0ee99d8a17036d6e9
Analysis cited: June 2026
Recorded activity: April 7, 2026

Script: gdrive_mail.ps1
SHA-256: 52a02a32d52454dc75bb23dbeaf6145002bb042a13dc529c91c727c6e5af54e7

The workshop also records an embedded Gmail app password. No credential value is reproduced here.

01 / Registry persistence

Legitimate programs.
An unexpected registry instruction.

Windows accessibility tools point to a command shell. The configured relationship gives the security team a specific mechanism to investigate.

F-IFEO-001 · High confidence

A registry instruction changes what Windows launches.

The report identifies debugger values for sethc.exe and magnify.exe that point to C:\windows\system32\cmd.exe. This configures an accessibility bypass at the logon screen.

What the evidence supports

The persistence mechanism is present in the inspected snapshot. The report found no execution telemetry in the windows around the registry writes, so it does not establish that the mechanism was used.

Persistence report

i-007021bb2f6d6e74a·f2a28438-7c71-5c22-92a6-0dc879e27f27HIGH suspicionHIGH confidence

Export FindingsStatus: Open Add exception...

Anchor: 2019-10-08T18:15:37Z
Detected: 2026-10-04T00:25:00Z
Report: pursuit-EC2AMAZ-SMASCMC-20261004

Gate 3 high: two validated IFEO debugger persistence entries set magnify.exe and sethc.exe Debugger to C:\windows\system32\cmd.exe. This is an attacker-relevant accessibility-backdoor mechanism. No execution telemetry was found in the bounded process/Security sources, so operational corroboration is limited. The separate EC2 password-rotation task and startup wallpaper scripts were inspected and remain low/benign context. No suspicious user-writable loaded driver or usable offensive framework was found.

AnalysisFindings3Attack Path4Evidence16CoverageRecovery

F-IFEO-001HIGH
IFEO debugger persistence for accessibility binaries
F-STARTUP-001LOW
Amazon EC2 startup-folder scripts validated as expected
F-TASK-001LOW
AWS password-reset scheduled tasks

F-IFEO-001

IFEO debugger persistence for accessibility binaries

high confidence

Gate 3: registry-backed Image File Execution Options Debugger values for magnify.exe and sethc.exe both redirect execution to C:\windows\system32\cmd.exe. This is attacker-relevant IFEO persistence and an accessibility/logon bypass mechanism. The target is a system command interpreter; no execution telemetry was recovered in the bounded windows around the writes.

Structured fields

category: ifeo_persistence
persistence_type: IFEO debugger

evidence_refs

E-IFEO-001E-TIMELINE-001E-TIMELINE-002

lol_bin

assessment: abused
name: cmd.exe
reason: cmd.exe is the IFEO debugger target for magnify.exe and sethc.exe.

hypothesis

An operator could obtain a command shell through accessibility binaries at the logon screen.

Raw finding JSON

E-IFEO-001 · Registry persistence

Follow the assessment back to the recorded values.

The evidence view links both accessibility programs to the command-shell target and records the write timestamps for each registry entry.

What the evidence supports

The displayed timestamps date the registry writes to October 8, 2019. They are historical evidence, not the date of an independently confirmed active attack.

Persistence report

i-007021bb2f6d6e74a·f2a28438-7c71-5c22-92a6-0dc879e27f27HIGH suspicionHIGH confidence

Export FindingsStatus: Open Add exception...

Anchor: 2019-10-08T18:15:37Z
Detected: 2026-10-04T00:25:00Z
Report: pursuit-EC2AMAZ-SMASCMC-20261004

AnalysisFindings3Attack Path4Evidence16CoverageRecovery

E-IFEO-001registry_persistence

type

registry_persistence

source_table

reg_autoruns

summary

IFEO Debugger values: sethc.exe -> C:\windows\system32\cmd.exe and magnify.exe -> C:\windows\system32\cmd.exe.

record_locator

SYSTEM\ControlSet001\ControlSet001\...\Image File Execution Options

key_fields

sethc_write_utc: 2019-10-08T16:46:45Z
magnify_write_utc: 2019-10-08T18:15:37Z

02 / PacketBuffer investigation

From the startup mechanism
to the behavior it enables.

The investigation connects the scripts, recurring execution, and supporting system records. Five findings have different confidence levels, with each conclusion tied to the evidence available.

F-001 · High confidence

A startup script captures TLS secrets.

The report connects packet_buffer.ps1 in Machine Group Policy Startup to Frida, lsass.exe, and tls.js. It describes TLS-secret capture and writes to a remote share.

What the evidence supports

The finding combines inspected script content with recorded execution. It identifies the capture chain; it does not claim that a fixed password or token was recovered.

Persistence report

i-0aa608f5a5afbf06e·b96d5aaa-7b53-59a9-af3f-f4503b67585fCRITICAL suspicionHIGH confidence

Export FindingsStatus: Open Add exception...

Anchor: 2023-02-09T10:58:30.3285501Z
Detected: 2026-10-07T00:00:00Z
Report: pursuit-20261007-win-host-1

Gate 4 critical: multiple independent Gate 3 mechanisms form an attacker-controlled chain. A machine Group Policy startup script is present and executed, launches Frida against lsass.exe, extracts TLS secrets, and writes them to a remote share; a hidden PowerShell Scheduled Job executes the same packet-buffer chain; and a common Startup shortcut targets disable_defender.ps1. The chain is corroborated by Sysmon process telemetry and repeated Elastic Agent service crashes.

AnalysisFindings5Attack Path6Evidence15CoverageRecovery

F-001HIGH
Privileged Group Policy startup script captures TLS secrets
F-002HIGH
Hidden PowerShell Scheduled Job provides recurring execution
F-003MEDIUM
Startup shortcut targets Defender-disabling script
F-004MEDIUM
EDR crash symptoms overlap the persistence window
F-005LOW
Non-standard Sysmon driver service residue

F-001

Privileged Group Policy startup script captures TLS secrets

high confidence

Gate 3 high. packet_buffer.ps1 is present under Machine Group Policy Startup and is executed with -ExecutionPolicy ByPass by gpscript.exe. Its inspected content waits for a remote share, runs dumpcap, launches Frida against lsass.exe with tls.js, hooks ncrypt.dll TLS key APIs, and writes CLIENT_RANDOM, master, traffic, and exporter secrets to \\10.10.200.40. This is attacker-relevant credential/session-secret capture with persistence and runtime corroboration.

Structured fields

category: malicious_persisted_script
persistence_type: group_policy_machine_startup

evidence_refs

E-001E-002E-003E-004

lol_bin

assessment: abused
name: PowerShell/gpscript
reason: PowerShell is used as the persisted script host and gpscript.exe invokes it at startup.

hypothesis

The script provides persistent privileged interception of encrypted traffic and secret material exfiltration to a network share.

Raw finding JSON

F-002 · High confidence

A hidden scheduled job launches the chain again.

The PacketBuffer PowerShell Scheduled Job runs hidden under the Administrator context. The report cites repeated Sysmon execution records alongside the Group Policy script.

What the evidence supports

The configured job and historical execution records support recurring execution. They do not establish that the job is running now.

Persistence report

i-0aa608f5a5afbf06e·b96d5aaa-7b53-59a9-af3f-f4503b67585fCRITICAL suspicionHIGH confidence

Export FindingsStatus: Open Add exception...

Anchor: 2023-02-09T10:58:30.3285501Z
Detected: 2026-10-07T00:00:00Z
Report: pursuit-20261007-win-host-1

AnalysisFindings5Attack Path6Evidence15CoverageRecovery

F-001HIGH
Privileged Group Policy startup script captures TLS secrets
F-002HIGH
Hidden PowerShell Scheduled Job provides recurring execution
F-003MEDIUM
Startup shortcut targets Defender-disabling script
F-004MEDIUM
EDR crash symptoms overlap the persistence window
F-005LOW
Non-standard Sysmon driver service residue

F-002

Hidden PowerShell Scheduled Job provides recurring execution

high confidence

Gate 3 high. The parsed task Microsoft\Windows\PowerShell\ScheduledJobs\PacketBuffer runs hidden PowerShell as WIN-HOST-1\Administrator and loads the PacketBuffer scheduled job from the Administrator profile. Sysmon records repeated executions, including 2023-02-09T10:58:57Z and nearby runs, alongside the Group Policy packet_buffer.ps1 execution.

Structured fields

category: scheduled_task_abuse
persistence_type: scheduled_task

evidence_refs

E-005E-006

lol_bin

assessment: abused
name: PowerShell
reason: Hidden non-interactive PowerShell loads and runs the persisted PacketBuffer job.

hypothesis

The task is a recurring launcher for the privileged packet/TLS-secret capture chain.

Raw finding JSON

F-003 · Medium confidence

A suspicious shortcut with a missing target.

A Startup shortcut points to disable_defender.ps1. The report cites an execution record for that path, but the script itself was absent from the acquired files table.

What the evidence supports

The shortcut and execution record are available. The missing script prevents validation of its payload behavior. Its filename alone does not prove Defender was disabled.

Persistence report

i-0aa608f5a5afbf06e·b96d5aaa-7b53-59a9-af3f-f4503b67585fCRITICAL suspicionHIGH confidence

Export FindingsStatus: Open Add exception...

Anchor: 2023-02-09T10:58:30.3285501Z
Detected: 2026-10-07T00:00:00Z
Report: pursuit-20261007-win-host-1

AnalysisFindings5Attack Path6Evidence15CoverageRecovery

F-001HIGH
Privileged Group Policy startup script captures TLS secrets
F-002HIGH
Hidden PowerShell Scheduled Job provides recurring execution
F-003MEDIUM
Startup shortcut targets Defender-disabling script
F-004MEDIUM
EDR crash symptoms overlap the persistence window
F-005LOW
Non-standard Sysmon driver service residue

F-003

Startup shortcut targets Defender-disabling script

medium confidence

Gate 2 medium. A present common Startup shortcut named disable-defender.lnk resolves in its embedded strings to PowerShell -ExecutionPolicy Bypass and a temporary disable_defender.ps1 path. The referenced script is absent from the acquired files table, so payload behavior is unverified. Sysmon independently records execution of that exact temporary script on 2023-02-09T14:22:51Z.

Structured fields

category: startup_folder_abuse
persistence_type: common_startup

evidence_refs

E-007E-008

lol_bin

assessment: present
name: PowerShell
reason: The shortcut embeds a PowerShell Bypass invocation.

hypothesis

The shortcut is suspicious Defender-tamper residue, but the missing target prevents validating its exact content.

Raw finding JSON

F-004 · Medium confidence

Service crashes overlap the execution window.

The report records Elastic Agent service termination events. One crash occurred about 80 seconds before the PacketBuffer execution cluster.

What the evidence supports

The timing provides corroborating context. It is not, by itself, proof that the capture chain caused the service crash or defeated the EDR.

Persistence report

i-0aa608f5a5afbf06e·b96d5aaa-7b53-59a9-af3f-f4503b67585fCRITICAL suspicionHIGH confidence

Export FindingsStatus: Open Add exception...

Anchor: 2023-02-09T10:58:30.3285501Z
Detected: 2026-10-07T00:00:00Z
Report: pursuit-20261007-win-host-1

AnalysisFindings5Attack Path6Evidence15CoverageRecovery

F-001HIGH
Privileged Group Policy startup script captures TLS secrets
F-002HIGH
Hidden PowerShell Scheduled Job provides recurring execution
F-003MEDIUM
Startup shortcut targets Defender-disabling script
F-004MEDIUM
EDR crash symptoms overlap the persistence window
F-005LOW
Non-standard Sysmon driver service residue

F-004

EDR crash symptoms overlap the persistence window

medium confidence

Gate 2 medium. Elastic Agent is installed and System event 7031 records unexpected service termination with exit code 1000 on 2023-02-09, 2022-10-25, and 2023-04-21. The 2023-02-09 crash occurs about 80 seconds before the recurring PacketBuffer execution cluster. This is corroborating tamper/anomalous behavior, not by itself proof of causation.

Structured fields

category: edr_av_bypass
persistence_type: none

evidence_refs

E-009

lol_bin

none

Raw finding JSON

F-005 · Low confidence

An unusual driver reference remains unresolved.

The service table contains a non-standard reference to SysmonDrv.sys. The expected-path lookup did not locate the file.

What the evidence supports

Driver content and user-writable placement remain unverified. The report retains suspicious residue and does not classify it as a confirmed vulnerable-driver load.

Persistence report

i-0aa608f5a5afbf06e·b96d5aaa-7b53-59a9-af3f-f4503b67585fCRITICAL suspicionHIGH confidence

Export FindingsStatus: Open Add exception...

Anchor: 2023-02-09T10:58:30.3285501Z
Detected: 2026-10-07T00:00:00Z
Report: pursuit-20261007-win-host-1

AnalysisFindings5Attack Path6Evidence15CoverageRecovery

F-001HIGH
Privileged Group Policy startup script captures TLS secrets
F-002HIGH
Hidden PowerShell Scheduled Job provides recurring execution
F-003MEDIUM
Startup shortcut targets Defender-disabling script
F-004MEDIUM
EDR crash symptoms overlap the persistence window
F-005LOW
Non-standard Sysmon driver service residue

F-005

Non-standard Sysmon driver service residue

low confidence

The service table contains SysmonDrv with image path SysmonDrv.sys and boot start, a non-absolute/non-standard driver reference. An exact expected system32 driver path lookup did not find the file, so user-writable placement and driver content are unverified. This is retained as suspicious residue rather than classified as a confirmed BYOVD load.

Structured fields

category: driver_persistence
persistence_type: driver_service

evidence_refs

E-010

lol_bin

none

Raw finding JSON

Report · Critical suspicion · High confidence

See how the individual findings connect.

The assessment connects the Group Policy startup script, hidden Scheduled Job, Startup shortcut, and supporting system records. It keeps the individual confidence levels visible.

What the evidence supports

This is the supplied product assessment of the inspected system and its historical evidence. It is not presented as a customer breach case or a measure of prevalence.

Persistence report

i-0aa608f5a5afbf06e·b96d5aaa-7b53-59a9-af3f-f4503b67585fCRITICAL suspicionHIGH confidence

Export FindingsStatus: Open Add exception...

Anchor: 2023-02-09T10:58:30.3285501Z
Detected: 2026-10-07T00:00:00Z
Report: pursuit-20261007-win-host-1

AnalysisFindings5Attack Path6Evidence15CoverageRecovery

Overall Assessment

Host: WIN-HOST-1

Network name: win-host-1.asgard.corp

Severity: CRITICAL

Confidence: HIGH

Gate 4 is met. Multiple independent persistence mechanisms form an

attacker-controlled chain:

- Machine Group Policy Startup contains and executes packet_buffer.ps1.
- The script launches Frida against lsass.exe, hooks TLS APIs through tls.js, captures session secrets, and writes them to \\10.10.200.40.
- A hidden PacketBuffer PowerShell Scheduled Job repeatedly launches the chain.
- A common Startup shortcut targets a missing disable_defender.ps1, and Sysmon records execution of that exact temporary script.
- Elastic Agent has repeated service termination events near the execution activity.

Key hashes:

- packet_buffer.ps1 MD5 1c80e6cdb3ca6e7147e04748ea33df4d; SHA256 e9776adb64a83154e447d9f359338997825a92d25b86f1a94f02cbdeb3b71ba7
- tls.js MD5 d96a6e6a8a663e5b8a3ec03bc7e9ea4d; SHA256 9fd39e27ee523a7a583d26190b0c3feb3e7668611d21055c9f32ab7970c1df6a
- disable-defender.lnk MD5 b2ed0e2a1db37d46c556e681907f0c53; SHA256 2ece48f52de6150cf65a0a49cb39e0771ffa1285e515e72c4a27ea53a0824279

Findings

F-001: High. The persisted Group Policy script is malicious: it launches Frida against lsass.exe, extracts TLS secrets, and writes them remotely. Credential assessment is present for TLS session secrets, but no fixed password or token value was found.

F-002: High. The hidden PacketBuffer Scheduled Job is present and repeatedly executed under the Administrator context.

F-003: Medium. disable-defender.lnk is present and points to an executed but missing temporary PowerShell script. The target behavior is unverified.

Scope and sources

Evidence with its context.

The research result and two public-image case summaries come from Elastio research. The product galleries retain their own report identifiers and analysis versions. Screens are evidence views, not additional counted images. They are not presented as customer breach accounts.

What a result means

A finding concerns the inspected image or snapshot and its available evidence. A configured persistence mechanism can matter even when an image is not running. Current activity, historical execution, and expected legitimate behavior are separate questions.

What these views establish

These views show the product’s assessments and evidence records. This page does not independently re-examine the original disk snapshots, validate the entire attack history, or compare tool detection rates.

How to evaluate a finding

Review the source image or snapshot version, analysis time, supporting artifacts, and intended system use. Read the confidence and coverage limits with the conclusion.

Review what is inside your own critical systems.

Plan your evaluation

Follow the finding.Inspect the evidence.

42 of 500Public marketplace machine imagescarried malicious persistence.

A vulnerable driver configured to load, with offensive tools on disk.

A scheduled task downloads files and sends them through email.

Legitimate programs.An unexpected registry instruction.

A registry instruction changes what Windows launches.

Follow the assessment back to the recorded values.

From the startup mechanismto the behavior it enables.

A startup script captures TLS secrets.

A hidden scheduled job launches the chain again.

A suspicious shortcut with a missing target.

Service crashes overlap the execution window.

An unusual driver reference remains unresolved.

See how the individual findings connect.

Evidence with its context.

What a result means

What these views establish

How to evaluate a finding

Review what is inside your own critical systems.

Follow the finding.
Inspect the evidence.

42 of 500Public marketplace machine images
carried malicious persistence.

Legitimate programs.
An unexpected registry instruction.

From the startup mechanism
to the behavior it enables.