What it does. Use Sysinternals Autoruns to systematically enumerate and analyze malware Part of mukul975/Anthropic-Cybersecurity-Skills (817 security skills) (mukul975/Anthropic-Cybersecurity-Skills).

Install

• npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill analyzing-malware-persistence-with-autoruns, or copy the skill folder into ~/.claude/skills/analyzing-malware-persistence-with-autoruns/.
• Raw file: curl -sL https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-malware-persistence-with-autoruns/SKILL.md

SKILL.md (verbatim)

name: analyzing-malware-persistence-with-autoruns
description: Use Sysinternals Autoruns to systematically enumerate and analyze malware
  persistence mechanisms across Windows registry run keys, scheduled tasks, services,
  drivers, and startup locations. Use when hunting for persistence during Windows
  incident response, triaging a compromised endpoint, or validating that malware
  autostart entries have been fully identified and removed.
domain: cybersecurity
subdomain: malware-analysis
tags:
- autoruns
- persistence
- malware-analysis
- sysinternals
- windows
- registry
- startup
- incident-response
mitre_attack:
- T1547.001
- T1543.003
- T1053.005
- T1574.001
- T1037.001
version: '1.0'
author: mahipal
license: Apache-2.0
d3fend_techniques:
- Executable Denylisting
- Execution Isolation
- File Metadata Consistency Validation
- Content Format Conversion
- File Content Analysis
nist_csf:
- DE.AE-02
- RS.AN-03
- ID.RA-01
- DE.CM-01

Analyzing Malware Persistence with Autoruns

Overview

Sysinternals Autoruns extracts data from hundreds of Auto-Start Extensibility Points (ASEPs) on Windows, scanning 18+ categories including Run/RunOnce keys, services, scheduled tasks, drivers, Winlogon entries, LSA providers, print monitors, WMI subscriptions, and AppInit DLLs. Digital signature verification filters Microsoft-signed entries. The compare function identifies newly added persistence via baseline diffing. VirusTotal integration checks hash reputation. Offline analysis via -z flag enables forensic disk image examination.

When to Use

• When investigating security incidents that require analyzing malware persistence with autoruns
• When building detection rules or threat hunting queries for this domain
• When SOC analysts need structured procedures for this analysis type
• When validating security monitoring coverage for related attack techniques

Prerequisites

• Sysinternals Autoruns (GUI) and Autorunsc (CLI)
• Administrative privileges on target system
• Python 3.9+ for automated analysis
• VirusTotal API key for reputation checks
• Clean baseline export for comparison

Workflow

Step 1: Automated Persistence Scanning

#!/usr/bin/env python3
"""Automate Autoruns-based persistence analysis."""
import subprocess
import csv
import json
import sys


def scan_and_analyze(autorunsc_path="autorunsc64.exe", csv_path="scan.csv"):
    cmd = [autorunsc_path, "-a", "*", "-c", "-h", "-s", "-nobanner", "*"]
    result = subprocess.run(cmd, capture_output=True, text=True, timeout=600)
    with open(csv_path, 'w') as f:
        f.write(result.stdout)
    return parse_and_flag(csv_path)


def parse_and_flag(csv_path):
    suspicious = []
    with open(csv_path, 'r', errors='replace') as f:
        for row in csv.DictReader(f):
            reasons = []
            signer = row.get("Signer", "")
            if not signer or signer == "(Not verified)":
                reasons.append("Unsigned binary")
            if not row.get("Description") and not row.get("Company"):
                reasons.append("Missing metadata")
            path = row.get("Image Path", "").lower()
            for sp in ["\temp\\", "\appdata\local\temp", "\users\public\\"]:
                if sp in path:
                    reasons.append(f"Suspicious path")
            launch = row.get("Launch String", "").lower()
            for kw in ["powershell", "cmd /c", "wscript", "mshta", "regsvr32"]:
                if kw in launch:
                    reasons.append(f"LOLBin: {kw}")
            if reasons:
                row["reasons"] = reasons
                suspicious.append(row)
    return suspicious


if __name__ == "__main__":
    if len(sys.argv) > 1:
        results = parse_and_flag(sys.argv[1])
        print(f"[!] {len(results)} suspicious entries")
        for r in results:
            print(f"  {r.get('Entry','')} - {r.get('Image Path','')}")
            for reason in r.get('reasons', []):
                print(f"    - {reason}")

Validation Criteria

• All ASEP categories scanned and cataloged
• Unsigned entries flagged for investigation
• Suspicious paths and LOLBin launch strings highlighted
• Baseline comparison identifies new persistence mechanisms

References

• Sysinternals Autoruns
• SANS - Offline Autoruns Revisited
• Hunting Malware with Autoruns
• MITRE ATT&CK T1547 - Boot or Logon Autostart

Other files in this skill

• LICENSE
• assets/template.md
• references/api-reference.md
• references/standards.md
• references/workflows.md
• scripts/agent.py

assets/template.md (verbatim)

Analysis Report Template - analyzing-malware-persistence-with-autoruns

Sample Information

Findings

IOCs Extracted

Recommendations

references/api-reference.md (verbatim)

API Reference: Autoruns Persistence Analysis

Autoruns CLI (autorunsc.exe)

autorunsc.exe -a * -c -h -s -v -vt -o autoruns.csv

CSV Columns

Autostart Categories

Suspicious Indicators

MITRE ATT&CK Persistence

• T1547.001 - Registry Run Keys / Startup Folder
• T1053.005 - Scheduled Task
• T1543.003 - Windows Service
• T1546.003 - WMI Event Subscription

references/standards.md (verbatim)

Standards Reference - analyzing-malware-persistence-with-autoruns

Applicable Standards

• MITRE ATT&CK Framework
• NIST SP 800-83 Guide to Malware Incident Prevention
• NIST SP 800-86 Guide to Integrating Forensic Techniques

Related MITRE ATT&CK Techniques

See SKILL.md for specific technique mappings.

references/workflows.md (verbatim)

Analysis Workflows - analyzing-malware-persistence-with-autoruns

Primary Workflow

[Sample Collection] --> [Static Analysis] --> [Dynamic Analysis] --> [IOC Extraction]
                                                                          |
                                                                          v
                                                                 [Report Generation]

See SKILL.md for detailed step-by-step procedures.

Back to mukul975/Anthropic-Cybersecurity-Skills (817 security skills) or Agent skills.