Question

During an internal engagement, a penetration tester used a PsExec-style tool to execute commands on several Windows servers via SMB. The tool created and started a temporary service that copied an executable into the C:\Windows directory on each target. Now that testing on those hosts is complete, which cleanup action most directly addresses the artifacts left by this specific technique?

Accepted Answer

Delete the dropped service binary from C:\Windows and remove the temporary service entry created during execution on each affected host

Answer

Reboot each affected server so that in-memory service handles are flushed automatically

Answer

Clear the Security event log on the domain controller to remove authentication records

Answer

Rotate the local administrator password used for the SMB connections on each host