analyzing-malware-persistence-with-autoruns

1# Analyzing Malware Persistence with Autoruns
2 
3## Overview
4 
5Sysinternals Autoruns extracts data from hundreds of Auto-Start Extensibility Points (ASEPs) on Windows, scanning 18+ categories including Run/RunOnce keys, services, scheduled tasks, drivers, Winlogon entries, LSA providers, print monitors, WMI subscriptions, and AppInit DLLs. Digital signature verification filters Microsoft-signed entries. The compare function identifies newly added persistence via baseline diffing. VirusTotal integration checks hash reputation. Offline analysis via -z flag enables forensic disk image examination.
6 
7 
8## When to Use
9 
10- When investigating security incidents that require analyzing malware persistence with autoruns
11- When building detection rules or threat hunting queries for this domain
12- When SOC analysts need structured procedures for this analysis type
13- When validating security monitoring coverage for related attack techniques
14 
15## Prerequisites
16 
17- Sysinternals Autoruns (GUI) and Autorunsc (CLI)
18- Administrative privileges on target system
19- Python 3.9+ for automated analysis
20- VirusTotal API key for reputation checks
21- Clean baseline export for comparison
22 
23## Workflow
24 
25### Step 1: Automated Persistence Scanning
26 
27```python
28#!/usr/bin/env python3
29"""Automate Autoruns-based persistence analysis."""
30import subprocess
31import csv
32import json
33import sys
34 
35 
36def scan_and_analyze(autorunsc_path="autorunsc64.exe", csv_path="scan.csv"):
37…