Tools · Windows security and Event Logs · 25 / 27
How to use Sysinternals Autoruns to review Windows startup persistence
Use Autoruns and autorunsc to list Run keys, services, tasks, WMI subscriptions, and more, hide signed Microsoft entries, and compare against a baseline.
Every autostart location in one view
Windows has dozens of places where a program can be configured to start automatically: Run and RunOnce registry keys, the Startup folder, services, drivers, scheduled tasks, Winlogon values, image file execution options, WMI event subscriptions, browser extensions, Office add-ins, and more. Autoruns from Microsoft Sysinternals lists them all with publisher, signature status, and file path.
autorunsc is the command-line version, which can output CSV for comparison and scripting.
Cut the noise
Options → Hide Microsoft Entries and Verify Code Signatures shrink the list dramatically. Entries remaining are third-party or unsigned. Highlighted rows in yellow point to missing files, and red rows are unsigned or have no publisher.
Check suspicious hashes against your threat intelligence or a reputation service, keeping in mind what data you send to third parties.
Lab: baseline and diff
On a clean lab VM, export a CSV baseline with autorunsc including hashes and signature checks. Add a Run key entry that starts notepad at logon and a scheduled task, then export again and diff the two files in PowerShell. The new entries stand out immediately.
Remove the test entries afterward. In a real environment, keep baselines per image and compare during investigations.
autorunsc64.exe -accepteula -a * -c -h -s -m -nobanner > C:\baseline.csv reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v LabNote /t REG_SZ /d "C:\Windows\notepad.exe" /f autorunsc64.exe -accepteula -a * -c -h -s -m -nobanner > C:\now.csv Compare-Object (Import-Csv C:\baseline.csv) (Import-Csv C:\now.csv) -Property 'Entry Location','Entry','Image Path' | Where SideIndicator -eq '=>' reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v LabNote /f
What to do with a finding
Do not just untick the box. Record the entry, its file, hash, and timestamps first. Unticking disables the entry in Autoruns, and deleting removes it, but neither removes the malware or explains how it got there.
Check WMI subscriptions especially carefully. They are less familiar to many administrators and survive reboots without any file in the Startup folder.
Diagram
Autostart locations Autoruns covers
A small selection of the tabs.
- Logon
Run keys, Startup folders, Winlogon.
- Services and Drivers
Automatic services and kernel drivers.
- Scheduled Tasks
Every registered task.
- WMI
Event filters and consumers.
- Image Hijacks
Debugger values and file associations.
Check yourself
1. Which Autoruns option shrinks the list to third-party entries?
2. Why compare against a baseline CSV?
3. Which persistence location do many administrators overlook?