| name | analyzing-malware-persistence-with-autoruns |
| description | Use Sysinternals Autoruns to systematically identify and analyze malware persistence mechanisms across registry keys, scheduled tasks, services, drivers, and startup locations on Windows systems. |
| domain | cybersecurity |
| subdomain | malware-analysis |
| tags | ["autoruns","persistence","malware-analysis","sysinternals","windows","registry","startup","incident-response"] |
| mitre_attack | ["T1547","T1053","T1543","T1546"] |
| version | 1.0 |
| author | mahipal |
| license | Apache-2.0 |
| d3fend_techniques | ["Executable Denylisting","Execution Isolation","File Metadata Consistency Validation","Content Format Conversion","File Content Analysis"] |
| nist_csf | ["DE.AE-02","RS.AN-03","ID.RA-01","DE.CM-01"] |
Analyzing Malware Persistence with Autoruns
Overview
Sysinternals Autoruns extracts data from hundreds of Auto-Start Extensibility Points (ASEPs) on Windows, scanning 18+ categories including Run/RunOnce keys, services, scheduled tasks, drivers, Winlogon entries, LSA providers, print monitors, WMI subscriptions, and AppInit DLLs. Digital signature verification filters Microsoft-signed entries. The compare function identifies newly added persistence via baseline diffing. VirusTotal integration checks hash reputation. Offline analysis via -z flag enables forensic disk image examination.
When to Use
- When investigating security incidents that require analyzing malware persistence with autoruns
- When building detection rules or threat hunting queries for this domain
- When SOC analysts need structured procedures for this analysis type
- When validating security monitoring coverage for related attack techniques
Detection Gaps & Validation
- Autoruns doesn't cover every ASEP. COM hijacking, certain WMI event-consumer subscriptions, and fully fileless/in-memory persistence may not surface. Corroborate with Sysmon (Event IDs 12-13, 19-21),
wmic/Get-WmiObject for __EventConsumer, and Volatility for memory-only implants.
- Live runs can be lied to. A rootkit on the running host can hide its own autostart entry; prefer offline analysis with
autorunsc -z against a mounted disk image, then diff against a clean baseline.
- Signed != trusted. Malware abuses signed LOLBins (
regsvr32, mshta, rundll32) and can sit behind a valid Microsoft signature; "Hide Microsoft entries" can mask a binary masquerading from System32. Verify the signature is valid (not just present) and that the path/name match the real product.
- Confirm a hit: check the hash on VirusTotal, validate the digital-signature state, confirm the launch string/path against a known-good baseline, and corroborate the entry from a second source (Sysmon, raw registry hive, scheduled-task XML) rather than Autoruns alone.
- False positives: legitimate line-of-business apps, OEM utilities, and dev tools are often unsigned, run from odd paths, or use script launchers. Require corroborating indicators before flagging an unsigned entry.
Prerequisites
- Sysinternals Autoruns (GUI) and Autorunsc (CLI)
- Administrative privileges on target system
- Python 3.9+ for automated analysis
- VirusTotal API key for reputation checks
