While investigating an alert in the CrowdStrike Falcon platform, you discover a registry key modification in…

Option A: The HKCU\Software\Microsoft\Windows\CurrentVersion\Run registry key is a common

persistence mechanism used by malware. The presence of a new executable in the AppData\Roaming

directory is particularly suspicious, as this directory is often exploited by attackers to store malicious

files. Further investigation is necessary to analyze the executable and mitigate the threat.

Option B: System optimization scripts rarely require registry modifications for persistence and are

generally stored in predefined system directories, not AppData. The context points more toward

malicious activity.

Option C: While some applications use AppData for updates, they generally overwrite existing files

rather than create new executables with corresponding registry entries. Validate this scenario against

update logs and application behavior.

Option D: Legitimate applications may add entries to this registry key, but these are typically well-

documented and located in program directories, not AppData\Roaming. The context of the directory and

newly created executable makes this explanation less likely.