Results for “autoruns”

Inspect Windows startup entries with Sysinternals Autoruns to find possible malware persistence, settings that let malware restart automatically. Review signatures, file locations, and changes from a clean baseline to identify entries that need investigation.

• Investigating suspicious startup entries on a Windows endpoint
• Comparing startup settings against a clean baseline
• Checking for remaining malware startup entries after cleanup

Find WMI event subscriptions that let attackers retain access to Windows systems. Correlate Sysmon events with stored subscriptions and Autoruns results, inspect execution triggers and commands, and document risks and recommended remediation.

• Triaging Sysmon alerts for events 19, 20, and 21
• Finding WMI persistence during incident response
• Distinguishing suspicious subscriptions from legitimate settings

Use Sysinternals Autoruns to systematically identify and analyze malware persistence mechanisms across registry keys, scheduled tasks, services, drivers, and startup locations on Windows systems.

The English summary is being prepared. Showing the original description.

Use Sysinternals Autoruns to systematically identify and analyze malware persistence mechanisms across registry keys, scheduled tasks, services, drivers, and startup locations on Windows systems.

The English summary is being prepared. Showing the original description.

Use Sysinternals Autoruns to systematically identify and analyze malware persistence mechanisms across registry keys, scheduled tasks, services, drivers, and startup locations on Windows systems.

The English summary is being prepared. Showing the original description.

Hunts for Windows persistence across autostart locations: Run keys, services, scheduled tasks, WMI event subscriptions, and startup folders, baselining them to surface anomalous or recently added entries. Activates for requests to hunt persistence, audit autostart extensibility points, or find malware autoruns on Windows.

The English summary is being prepared. Showing the original description.

Guide malware cleanup on infected Windows and Linux systems after containment and investigation. Covers removing malicious files and mechanisms that preserve attacker access, rotating credentials, patching entry points, and documenting validation results before recovery.

• Cleaning infected systems after containment
• Removing mechanisms that preserve attacker access
• Rotating compromised credentials and fixing entry points

Investigate Windows malware that runs in memory or abuses legitimate system tools. Use logs, registry entries, and memory dumps to trace persistence, identify suspicious activity, and produce detection rules and an analysis report.

• Investigating suspicious PowerShell activity
• Checking WMI persistence mechanisms
• Finding malicious code in memory dumps

Windows local privilege escalation playbook. Use when you have low-privilege shell access on Windows and need to escalate via token abuse, Potato exploits, service misconfigurations, DLL hijacking, UAC bypass, or registry autoruns.

The English summary is being prepared. Showing the original description.