The output can also be redirected to a text file for reference and easy recording. Tools from Sysinternals Suite by Microsoft Windows “autorunsc.exe” (command-line) and “Autoruns.exe” (graphical user interface) can help to see all Autorun programs in your machine which can be downloaded on the link below.Īdding the parameter “hyphen h” (-h) to the command autorunsc.exe will give you the MD5 or SHA-256 hashes of the file to check from the Open Source Intelligence (OSInt) websites for Malicious file and URL called VirusTotal( ) There are so huge places in the system that an adversary can plant their malicious programs and run automatically during boottime without an end-user’s awareness. Hunting Persistent Threat with Autorun Programs

This article aims to empower non-security folks to gain a portion of technical knowledge on hunting threats from their Windows systems and able to share to their families and friends as well using freely available and downloadable tools from the Internet. The malware or malicious software includes but not limited to Keylogger, credential stealers, crypto miner, reverse shell, ransomware, botnet, and more. Human is the weakest link among the security chain so as an end-user, anyone should have the basic understanding of how tofind malicious activities and files within their workstations.

However, security is not just for the IT security folks who are paid mainly to do this kind of “Blue Teaming” work ( aka Incident Responders) but it is everyone’s responsibility.

And this is usually done with the help of different tools that we call “arsenals” SIEM ( security information and event management) and EDR ( endpoint detection and response) mostly. Threat hunting is a proactive task with an assumption that your organization has already been breached and you wanted to beat the average “dwell time” of 256 days at least for me as a DFIR practitioner.

Sysinternals suite cnet