Autoruns cli

autorunsc.exe -accepteula -a * -c

CLI version of Autoruns to inventory host persistence and automate scanning in scripts or across multiple machines.

Run it when you need the persistence inventory in a processable and repeatable format: autorunsc generates the CSV of all startup points without opening the GUI, allowing you to launch it remotely (PsExec, WinRM), loop through multiple hosts, or integrate it into the IR collection playbook. The -accepteula avoids the license prompt (essential in automated deployments). In an IR with dozens of hosts, the autorunsc loop over each one plus a 'No verified' filter is the persistence sweep at scale — the same data as the GUI but without touching each machine manually.

Don't use it if you need to explore the GUI (the tabs and jump to entries speed up manual analysis of a specific host). The raw CSV output is noisy: filtering by signature and category is mandatory, and on hosts with legacy software, legitimate unsigned entries (old drivers, vertical software) generate false positives — you need to know the environment to separate them. And watch out: autorunsc remotely requires administrative privileges on the host and the network path; on hosts without admin, the HKLM view is incomplete.