Autoruns analysis

autoruns.exe -a * -c

Lists everything that runs at Windows startup (Run keys, services, tasks, DLLs) in CSV to detect persistence.

Run it when you want the persistence inventory of a host: Autoruns goes through all automatic startup points — HKCU/HKLM Run keys, startup folders, services, scheduled tasks, drivers, boot DLLs, Winlogon — and lists them with the binary signature. The CSV output (-c) is the one to process: you filter by 'Not signed' and by user paths, and what's left is the suspicious persistence. It's the IR reference tool to answer 'what survives a reboot on this host?'.

Don't use it on unfiltered hosts: the full Autoruns list on a system with installed software has hundreds of entries and most are legitimate (signed). The value is in the filter (unsigned, user paths, hidden entries with -h) — running it and looking at everything is a waste of time. It also doesn't detect persistence that isn't in the startup points (WMI subscriptions, COM hijacking with weird GUIDs appear, but persistence in memory or via scheduled tasks of another user requires other views). On hosts with lots of software, use the option to hide Microsoft entries (-hide Microsoft) to reduce noise.