Autoruns
You can learn which Windows persistence mechanisms are checked by looking at the output of Autoruns on your own client. Categories and the different locations where things were found are seen in the output. A disassembly of Autoruns lists a subset of the entries which are…
- from
- Malware Persistence
- added
- 2026-10-10
- likes
- 0
similar
-
Autoruns technet.microsoft.com
A powerful persistence collection tool on Windows is Autoruns. It collects different categories and persistence information from a live system and in limited ways from offline images. There is a UI and a command line program and the output format can be set to CSV which can…
-
PowerShell implementation of Autoruns github.com
Another way to find Windows persistence locations is to look at the source code of the PowerShell version of Autoruns. Bonus: A history of the covered persistence locations for each Autoruns version is found at the end of the module file too, which is so awesome!
-
Malware persistence techniques andreafortuna.org
Good summary of multiple persistence mechanisms, ranging from multiple registry keys to more advanced one, like COM hijacking.
-
PowerShell Autoruns github.com
A PowerShell version of Autoruns.
-
RegRipper github.com
Extracts various persistence mechanisms from the registry files directly.
-
How malware persists on macOS sentinelone.com
List of macOS persistence mechanisms.
Malware Persistence › Techniques > Windows: “You can learn which Windows persistence mechanisms are checked by looking at the output of Autoruns on your own client. Categories and the different locations where things were found are seen in the output. A disassembly of Autoruns lists a subset of the entries which are…”