F018Inconclusivevalidator: blocked
SafeBoot AlternateShell registry persistence
SafeBoot AlternateShell persistence
Analyst narrative
Registry persistence facts for SafeBoot AlternateShell under ControlSet001/002 flagged as high-risk persistence. Candidates cand-0099/cand-0100.
Claims asserted
pathregistry_persistence_fact-0001592
Proof chain · 0 facts
Every confirmed claim links by foreign key to the typed fact that validated it, and to the forensic tool that produced that fact. This is one finding_trace() query.