| name | analyzing-malware-persistence-with-autoruns |
| description | 使用 Sysinternals Autoruns 系统化识别和分析 Windows 系统上注册表键、计划任务、服务、驱动程序和启动位置中的恶意软件持久化机制。 |
| domain | cybersecurity |
| subdomain | malware-analysis |
| tags | ["autoruns","persistence","malware-analysis","sysinternals","windows","registry","startup","incident-response"] |
| version | 1.0 |
| author | mahipal |
| license | Apache-2.0 |
使用 Autoruns 分析恶意软件持久化
概述
Sysinternals Autoruns 从 Windows 上的数百个自动启动扩展点（ASEP）提取数据，扫描 18 个以上类别，包括 Run/RunOnce 键、服务、计划任务、驱动程序、Winlogon 条目、LSA 提供程序、打印监视器、WMI 订阅和 AppInit DLL。数字签名验证过滤 Microsoft 签名条目。比较功能通过基线差异识别新增的持久化机制。VirusTotal 集成检查哈希信誉。通过 -z 标志进行离线分析，支持取证磁盘镜像检查。
前置条件
- Sysinternals Autoruns（GUI）和 Autorunsc（CLI）
- 目标系统上的管理员权限
- Python 3.9+，用于自动化分析
- VirusTotal API 密钥，用于信誉检查
- 干净的基线导出，用于比对
操作步骤
步骤 1：自动化持久化扫描
"""自动化基于 Autoruns 的持久化分析。"""
import subprocess
import csv
import json
import sys
def scan_and_analyze(autorunsc_path="autorunsc64.exe", csv_path="scan.csv"):
cmd = [autorunsc_path, "-a", "*", "-c", "-h", "-s", "-nobanner", "*"]
result = subprocess.run(cmd, capture_output=True, text=True, timeout=600)
with open(csv_path, 'w') as f:
f.write(result.stdout)
return parse_and_flag(csv_path)
def parse_and_flag(csv_path):
suspicious = []
with open(csv_path, 'r', errors='replace') as f:
for row in csv.DictReader(f):
reasons = []
signer = row.get("Signer", "")
if not signer or signer == "(Not verified)":
reasons.append("未签名的二进制文件")
if not row.get("Description") and not row.get("Company"):
reasons.append()
path = row.get(, ).lower()
sp [, , ]:
sp path:
reasons.append()
launch = row.get(, ).lower()
kw [, , , , ]:
kw launch:
reasons.append()
reasons:
row[] = reasons
suspicious.append(row)
suspicious
__name__ == :
(sys.argv) > :
results = parse_and_flag(sys.argv[])
()
r results:
()
reason r.get(, []):
()
验证标准
- 扫描并记录所有 ASEP 类别
- 标记未签名条目以供调查
- 突出显示可疑路径和 LOLBin 启动字符串
- 基线比较识别新的持久化机制
参考资料
