After Establishing a Shell on a Target System, Joe, a Penetration

Multiple Choice

After establishing a shell on a target system, Joe, a penetration tester is aware that his actions have not been detected. He now wants to maintain persistent access to the machine. Which of the following methods would be MOST easily detected?

A) Run a zero-day exploit.
B) Create a new domain user with a known password.
C) Modify a known boot time service to instantiate a call back.
D) Obtain cleartext credentials of the compromised user.