PowerShell implementation of Autoruns
A PowerShell module for live incident response that enumerates Windows autorun artifacts to detect persistence mechanisms used by malware and legitimate programs.
What is PowerShell implementation of Autoruns?
AutoRuns is a PowerShell module that enumerates Windows autorun artifacts to help security professionals detect persistence mechanisms during live incident response. It scans various autostart locations like registry keys, scheduled tasks, services, and WMI entries to identify potential malware or legitimate programs that achieve persistence. The module provides features like file hash computation, digital signature verification, and baseline comparison to track changes over time.
Security analysts, incident responders, and forensic investigators who need to analyze Windows systems for persistence mechanisms during live investigations or routine security audits.
Developers choose AutoRuns because it offers a scriptable, PowerShell-native alternative to GUI tools like Sysinternals Autoruns, enabling automation, integration into security workflows, and detailed analysis with features like baseline comparison and user-specific scanning.
Overview
🚀AutoRuns is a PowerShell module that will help do live incident response and enumerate autoruns artifacts that may be used by legitimate programs as well as malware to achieve persistence.
Use Cases
Best For
- Live incident response on Windows systems
- Detecting malware persistence mechanisms
- Creating baselines of system autorun artifacts
- Comparing system states before and after an incident
- Analyzing autorun entries for specific user profiles
- Automating security audits with PowerShell scripts
Not Ideal For
- Incident responders needing offline Windows image analysis (feature marked as todo in README)
- Environments with strict AppLocker policies without GPO adjustments (requires manual rule creation)
- Teams preferring GUI-based tools over command-line interfaces for interactive exploration
- Fully automated deployments requiring no manual code review (emphasizes user verification for trust)
Pros & Cons
Pros
Scans over 15 autostart locations including registry, services, WMI, and scheduled tasks, matching the depth of Sysinternals Autoruns.exe.
Optionally computes SHA256 hashes and verifies digital signatures to flag suspicious binaries, aiding in malware detection.
Allows creating and comparing system baselines with dedicated functions like Compare-AutoRunsBaseLine, useful for tracking changes over time.
Supports scanning autorun artifacts for specific user profiles via the -User parameter, not limited to the current user.
Encourages code review and provides catalog file verification, aligning with security best practices for trust.
Cons
Installation requires saving, reviewing code, and verifying hashes manually, adding steps compared to simpler modules.
Cannot analyze offline Windows images yet, as noted in the Todo list, limiting forensic use cases.
May fail on systems with AppLocker in allow mode unless GPO rules are adjusted, as admitted in the Issues section.
Help has limited examples, and the Todo lists 'More examples' and external help as pending, hindering quick adoption.
Open Source Alternative To
PowerShell implementation of Autoruns is an open-source alternative to the following products:
Frequently Asked Questions
Related Projects
PersistenceSniperPowershell module that can be used by Blue Teams, Incident Responders and System Administrators to hunt persistences implanted in Windows machines. Official Twitter/X account @PersistSniper. Made with ❤️ by @last0x00 and @dottor_morte
AutorunsToWinEventLog.ps1A repository for using windows event forwarding for incident detection and response
PyrsistenceSniperWe took PersistenceSniper, merged it with Python, and misspelled it on purpose. Meet PyrsistenceSniper.
hasherezade persistence demosDemos of various (also non standard) persistence methods used by malware
Found a gem we're missing?
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.