AutoRuns - 🚀AutoRuns is a PowerShell module that will help d

项目说明

AutoRuns PowerShell Module
==========================

AutoRuns module was designed to help do li response and enumerate autoruns artifacts that may be used by legitimate programs as well as malware to achie.

Table of Contents

* Usage
* Install the module
* Functions
* Help
* Issues
* Todo
* Credits
* Original Autoruns doc
* Original Autoruns.exe release history

<a name="Usage"/>

Usage

<a name="Install"/>

Install the module

The module is located on the PowerShellGallery

Stop and please review the content of the module, I mean the code to make sure it's trustworthy :-)

You can also that the SHA256 hashes of downloaded files match those stored in the catalog file

<a name="Functions"/>

Check the command a

<a name="Help"/>

Find the syntax

#### Get-PSAutorun

#### New-AutoRunsBaseLine

#### Compare-AutoRunsBaseLine

View examples provided in the help

#### Get-PSAutorun

#### New-AutoRunsBaseLine

#### Compare-AutoRunsBaseLine

<a name="Issues"/>

Issues

* What are registrations in the WMI\Default namespace introduced in Autoruns v13.7? see c7eab48c77f578e0dcff61d2b46a479b28225a56

* If you run PowerShell 5.1 and Applocker in allow mode, you need to add a local appplocker rule that allows the module to be loaded.
The module files aren't signed anymore with a DigiCert certificate.

If your corporate admin has turned off local group policy objects processing on a domain joined device, you'll need to add the trusted publisher rule in a Domain group policy.

<a name="Todo"/>

Todo

#### Coding best practices

[x] Use PSScriptAnalyzer module to the code follows best practices

[x] Write Pester tests for this module

#### OS and Software compatibility

[x] Test the module in PowerShell Core 7.x (latest)

[x] Test the module on of Windows 11

- [x] 23H2
- [ ] 25H2
- [ ] 26H2

[ ] Review Office Add-ins code with Office x86 and x64

#### General impro

[ ] Write a better implementation of the internal Get-RegValue function

[ ] Review and impro used by the internal Get-PSPrettyAutorun function (ex: external paths)

#### New features

[x] Replace HKCU and add an option to specify what user hive is being in

[ ] Add timestamps on registry keys

[ ] Analyze an offline image of Windows

[x] Create a baseline of artifacts

[x] Compare two baselines of artifacts

#### Help

[ ] More examples

[ ] Use external help?

[ ] Internationalization?

[ ] Copy the changelog at the end of the module in README.md

[x] Document issues and write a pester tests to the module behavior if fixed

<a name="Credits"/>

Credits

Thanks go to:
* :
* Improving common parameters 7fe8e7ea983325b5543da1300cb8a4636c7062ef
* Filtering OS binaries 8efb0fad4585ecd4517b55ff5b5cec91f7dd364a

<a name="AutorunsDoc"/>

Other links

<a name="AutorunsHistory"/>

Original Autoruns.exe from Mark Russinovich

Autoruns v14.3
>This update to Autoruns, a utility for monitoring startup items, adds bug fixes and fully aligns the command-line autorunsc with the GUI capabilities, including packaged apps support.

Autoruns v14.2
>This update to Autoruns, a utility for monitoring startup items, adds support for Windows packaged apps.

Autoruns v14.11
>This update to Autoruns fixes a bug parsing parameters in startup folder items.

Autoruns v14.1
>This update to Autoruns, a utility for monitoring startup items, fixes a bug with detecting non-shortcut files in startup folders, fixes a bug with handling non-UNC, non-absolute paths, and impro support.

Autoruns v14.09
>This Autoruns update fixes a bug pre the enabling/disabling of startup folder items.

Autoruns v14.08
>This Autoruns update fixes a series of application crashes, now correctly parses paths with spaces passed as command line arguments and improves .arn import functionality.

Autoruns v14.07
>This Autoruns update can open .arn files from the command line, fixes RunDll32 parameter handling in some cases, supports toggling Acti entries, fixes a crash when no ProcExp can be found in the path and improves 32/64 bit redirection.

Autoruns v14.06
>This Autoruns release fixes a crash happening for scheduled tasks containing spaces.

Autoruns v14.05
>This update for Autoruns addresses a bug pre opening and comparing .arn files.

Autoruns v14.04
>This update for Autoruns adds a series of display/theme fixes, restores autorunsc, fixes a regression for rundll32 entries, limits per-user scans to the user locations, fixes Microsoft entry hiding and adds a high DPI application icon.

Autoruns v14.03
>This update for Autoruns restores entries pre shown in v13.100, impro redirection handling and entry name resolution.

Autoruns v14.02
>Autoruns, a utility for monitoring startup items, receives a series of UI impro related to the dark theme and general Windows 10 tweaks, and signed files regressions fixes.

Autoruns v14.01
>This update for Autoruns fixes a regression with submissions introduced in v14.0.

Autoruns v14.0
>Autoruns, a utility for monitoring startup items, is the latest Sysinternals tool to receive a UI o including a dark theme.

Autoruns v13.100
>This update to Autoruns fixes a crash reported in v13.99.

Autoruns v13.99
>This update to Autoruns fixes a bug that resulted in some empty locations being hidden when the Include Empty Locations option is selected.

Autoruns v13.98
>This release of Autoruns resolves an issue where Microsoft Defender binaries were being flagged as unsigned.

Autoruns v13.95
>This Autoruns update adds support for user Shell folders redirections.

Autoruns v13.94
>This Autoruns update fixes a bug that pre the correct display of the target of image hosts such as s.exe, rundll32.exe, and cmd.exe.

Autoruns v13.93
>This Autoruns update fixes a bug that pre UserInitMprLogonScript from being scanned and by-default enables HCKU scanning for the console .

Autoruns v13.90
>Autoruns, a comprehensi autostart entry point (ASEP) manager, now includes Runonce\*\Depend keys and GPO logon and logoff locations, as well as fixes a bug in WMI path parsing.

Autoruns v13.82
>This Autoruns release shows Onenote addins and fixes several bugs.

Autoruns v13.81
> This update to Autoruns fixes a Wow64 bug in Autorunsc that could cause 32-bit paths to result in 'file not found' errors, and expands the set of images not considered part of Windows for the Windows filter in order to reveal malicious files masquerading as Windows images

Autoruns v13.80
> This release of Autoruns, a utility for and managing autostart execution points (ASEPs), adds additional autostart entry points, has asynchronous file saving, fixes a bug parsing 32-bit paths on 64-bit Windows, shows the display name for drivers and services, and fixes a bug in offline Virus Total scanning.

Autoruns v13.71
> This update to Autoruns, a comprehensi execution point manager, adds Microsoft HTML Application Host (mshta.exe) as hosting image so it displays the hosted image details, and now doesn’t apply filters to hosting images.

Autoruns v13.7
> Autoruns, an autostart entry point management utility, now reports print pro, registrations in the WMI\Default namespace, fixes a KnownDLLs enumeration bug, and has impro usability on high-DPI displays.

Autoruns v13.51
> This release of Autoruns, a comprehensi entry manager, fixes a WMI command-line parsing bug, emits a UNICODE BOM in the file generated when saving results to a text file, and adds back the ability to selectively the signing status of indi entries.

Autoruns v13.5
>This update to Autoruns, the most comprehensi and manager a for Windows, now shows 32-bit Office addins and font drivers, and enables resubmission of known images to Virus Total for a new scan.

Autoruns v13.4
>Autoruns, the most comprehensi a for showing what executables, DLLs, and drivers are configured to automatically start and load, now reports Office addins, adds several additional autostart locations, and no longer hides hosting executables like cmd.exe, powershell.exe and others when Windows and Microsoft filters are in effect.

Autoruns v13.3
>Autoruns, a utility that shows what processes, DLLs, and drivers are configured to automatically load, adds reporting of GP extension DLLs and now shows the target of hosting processes like cmd.exe and rundll32.exe.

Autoruns v13.2
>In addition to bug fixes to CSV and XML output, Autorunsc introduces import-hash reporting, and Autoruns now excludes command-line and other host processes from the Microsoft and Windows filters.

Autoruns v13.01
>This release fixes a bug in v13 that caused autostart entry lines not to show when you enter a filter string into the toolbar's filter control

Autoruns v13.0
> This major update to Autoruns, an autostart execution point (ASEP) manager, now has integration with .com to show the status of entries with respect to scans by over four dozen antimalware engines. It also includes a re scanning architecture that supports dynamic filters, including a free-form text filter, a greatly impro feature that highlights not just new items but deleted ones as well, and file saving and loading that preserves all the information of a scan

Autoruns v12.03
>This update to Autoruns adds the registered HTML file extension, fixes a bug that could cause disabling of specific entry types to fail with a “path not found” error, and addresses another that could prevent the Jump-to-image function from opening the selected image on 64-bit Windows.

Autoruns v12.02
>This fixes a bug that could cause Autoruns to crash on startup, updates the image path parsing for Installed Components to remo positi entries, and correctly reports image entry timestamps in local time instead of UTC.

Autoruns v12.01
>This update to Autoruns, a utility that comes in Windows application and command-line forms, has numerous bug fixes, adds a profile attribute/column to CSV and XML output, and interprets the CodeBase value for COM object registrations.

Autoruns v12.0
>This release of Autoruns, a Windows application and command-line utility for autostart entries, now reports the presence of batch file and executable image entries in the WMI database, a used by some types of malware.

Autoruns v11.70
>This release of Autoruns, a powerful utility for scanning and disabling autostart code, adds a new option to have it show only per-user locations, something that is useful when analyzing the autostarts of different accounts than the one that Autoruns is running under.

Autoruns v11.62
>This release fixes a bug in 11.61’s jump-to-image functionality.

项目信息

开发语言：PowerShell

Star 数：307

技术要点

该项目属于病毒分析方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕 🚀AutoRuns is a PowerShell module that will help do live incident response and enumerate autoruns artifacts that may be used by legitimate programs as well as malware to achieve persistence.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。