TH-0006-Autoruns Analysis

Creation Date: 2020/06/28

Author: svch0st

Target Platform: Windows

Analytics:

Autorunsc.exe - Custom Output

Hypothesis

Adversaries may try to gain persistence by using the autorun or ASEP locations in Windows

Description

The Sysinternals tool Autoruns checks the registry and file system for known identify persistence mechanisms. It will output any tools identified, including built-in or added-on Microsoft functionality and third party software. Many of these locations are known by adversaries and used to obtain Persistence.

ATT&CK Detection

Technique	Subtechnique(s)	Tactic(s)
Create or Modify System Process	Windows Service	Persistence, Execution
Scheduled Task/Job	At (Windows), Scheduled Task	Execution, Persistence, Privilege Escalation
Event Triggered Execution	Windows Management Instrumentation Event Subscription, Image File Execution Options Injection, PowerShell Profile	Persistence, Privilege Escalation
Boot or Logon Initialization Scripts	Logon Script (Windows), Startup Items	Persistence, Privilege Escalation
Boot or Logon Autostart Execution	Registry Run Keys / Startup Folder	Persistence, Privilege Escalation

Analytics

Autorunsc.exe

Data Source: Custom Output

Description: Running the tool and outputting it to a network share will allow you to analyse these important data points

Logic:

Use frequency analysis on the entries to look at abnormalites on your systems
Compare a snapshot of a known good image to filter out the noise of save or expected entries.