Анализ закрепления вредоноса через Autoruns

★ 8.4 · security

analyzing-malware-persistence-with-autoruns is a Claude Code skill that systematically enumerates and analyzes malware persistence mechanisms using Sysinternals Autoruns, covering 18+ Auto-Start Extensibility Point categories: Run/RunOnce registry keys, scheduled tasks, services, drivers, Winlogon entries, LSA providers, WMI subscriptions, and AppInit DLLs. A built-in Python script runs autorunsc64.exe, parses the CSV output, and automatically flags suspicious entries — unsigned binaries, missing metadata, temp-directory paths, and LOLBin launch strings such as powershell, mshta, and regsvr32. Baseline diffing identifies newly added autostart entries, and the -z flag supports offline forensic disk image analysis. The skill maps to MITRE ATT&CK techniques T1547.001, T1543.003, T1053.005, and T1574.001, making it directly applicable for SOC analysts triaging compromised Windows endpoints and threat hunters validating full removal of malware autostart entries.

• #malware-analysis
• #persistence
• #autoruns
• #sysinternals
• #windows
• #registry
• #incident-response