Autoruns — authorized persistence inventory
Autoruns (Microsoft Sysinternals) inventories where Windows is told to auto-start code. Use it on hosts you are authorized to examine — typically lab VMs or IR images under a ticket.
Snapshot
| Field | Value |
|---|---|
| Publisher | Microsoft Sysinternals |
| Job | Persistence / auto-start inventory |
| Suite map | Sysinternals Suite overview |
| Live activity peer | Process Monitor |
| Suspicious module peer | pe-sieve (different job; authorized malware labs) |
Allowed framing
- Diffing Autoruns exports between a clean lab snapshot and a post-exercise VM.
- Teaching students that "signed" ≠ "expected in this image."
- Exporting CSV/ARN results into Evidence with hostname and collection time.
Scope we will not cover
- No stealth persistence authoring guides.
- No AV/EDR bypass cookbooks.
- No credential theft via scheduled tasks or COM abuse recipes.
- No crack/keygen framing.
Beginner path (authorized only)
- Snapshot a clean lab VM; run Autoruns; export baseline.
- Install a known lab agent you control; re-run and diff.
- Document Hide options (Microsoft/Windows entries) so peers can reproduce the view.
- If you need runtime confirmation of what executed, add a Procmon trace under the same authorization.
- Escalate unknown binaries with hashes → DiE/capa/Ghidra — still authorized-only.
- Use Autoruns for authorized persistence inventory against a baseline.
- Prefer exports + golden-image diffs over screenshot-only reporting.
- Refuse stealth persistence, AV-bypass and crack framing.
For legal, authorized and educational use only.
FAQ
What does Autoruns show?
Autoruns enumerates many Windows auto-start extensibility points (services, Run keys, scheduled tasks, Explorer shell extensions, and more — per current Microsoft docs) so labs can inventory what persists across logon/boot.
Is a listed entry automatically malware?
No. Legitimate software registers persistence too. Compare against a golden image or known-good baseline before escalating.
Autoruns vs Procmon?
Procmon answers what a process did in a time window. Autoruns answers what is configured to start. Use both under authorization.
Hide Microsoft entries?
The UI can hide signed Microsoft entries to reduce noise — useful in labs, dangerous if you blindly trust signatures alone. Document the view options you used.
Does this teach writing stealthy persistence or bypassing AV?
No. Authorized inventory and education only — BinBench will not supply stealth persistence, AV-bypass or anti-forensics cookbooks.