Use Sysinternals Autoruns to systematically enumerate and analyze malware persistence mechanisms across Windows registry run keys, scheduled tasks, services, drivers, and startup locations. Use when hunting for persistence during Windows incident response, triaging a compromised endpoint, or validat

Analyzing Malware Persistence with Autoruns Overview Sysinternals Autoruns extracts data from hundreds of Auto Start Extensibility Points (ASEPs) on Windows, scanning 18+ categories including Run/RunOnce keys, services, scheduled tasks, drivers, Winlogon entries, LSA providers, print monitors, WMI subscriptions, and AppInit DLLs. Digital signature verification filters Microsoft signed entries. The compare function identifies newly added persistence via baseline diffing. VirusTotal integration checks hash reputation. Offline analysis via z flag enables forensic disk image examination. When to Use When investigating security incidents that require analyzing malware persistence with autoruns When building detection rules or threat hunting queries for this domain When SOC analysts need structured procedures for this analysis type When validating security monitoring coverage for related attack techniques Prerequisites Sysinternals Autoruns (GUI) and Autorunsc (CLI) Administrative privileges on target system Python 3.9+ for automated analysis VirusTotal API key for reputation checks Clean baseline export for comparison Workflow Step 1: Automated Persistence Scanning Validation Criteria All ASEP categories scanned and cataloged Unsigned entries flagged for investigation Suspicious paths and LOLBin launch strings highlighted Baseline comparison identifies new persistence mechanisms References [Sysinternals Autoruns](https://learn.microsoft.com/en us/sysinternals/downloads/autoruns) [SANS Offline Autoruns Revisited](https://www.sans.org/blog/offline autoruns revisited auditing malware persistence/) [Hunting Malware with Autoruns](https://nasbench.medium.com/hunting malware with windows sysinternals autoruns 19cbfe4103c2) [MITRE ATT&CK T1547 Boot or Logon Autostart](https://attack.mitre.org/techniques/T1547/)

analyzing-malware-persistence-with-autoruns