Analyzing Malware Persistence with Autoruns

Overview

Sysinternals Autoruns extracts data from hundreds of Auto-Start Extensibility Points (ASEPs) on Windows, scanning 18+ categories including Run/RunOnce keys, services, scheduled tasks, drivers, Winlogon entries, LSA providers, print monitors, WMI subscriptions, and AppInit DLLs. Digital signature verification filters Microsoft-signed entries. The compare function identifies newly added persistence via baseline diffing. VirusTotal integration checks hash reputation. Offline analysis via -z flag enables forensic disk image examination.

Prerequisites

• Sysinternals Autoruns (GUI) and Autorunsc (CLI)
• Administrative privileges on target system
• Python 3.9+ for automated analysis
• VirusTotal API key for reputation checks
• Clean baseline export for comparison

Practical Steps

Step 1: Automated Persistence Scanning

#!/usr/bin/env python3
"""Automate Autoruns-based persistence analysis."""
import subprocess
import csv
import json
import sys


def scan_and_analyze(autorunsc_path="autorunsc64.exe", csv_path="scan.csv"):
    cmd = [autorunsc_path, "-a", "*", "-c", "-h", "-s", "-nobanner", "*"]
    result = subprocess.run(cmd, capture_output=True, text=True, timeout=600)
    with open(csv_path, 'w') as f:
        f.write(result.stdout)
    return parse_and_flag(csv_path)


def parse_and_flag(csv_path):
    suspicious = []
    with open(csv_path, 'r', errors='replace') as f:
        for row in csv.DictReader(f):
            reasons = []
            signer = row.get("Signer", "")
            if not signer or signer == "(Not verified)":
                reasons.append("Unsigned binary")
            if not row.get("Description") and not row.get("Company"):
                reasons.append("Missing metadata")
            path = row.get("Image Path", "").lower()
            for sp in ["\temp\\", "\appdata\local\temp", "\users\public\\"]:
                if sp in path:
                    reasons.append(f"Suspicious path")
            launch = row.get("Launch String", "").lower()
            for kw in ["powershell", "cmd /c", "wscript", "mshta", "regsvr32"]:
                if kw in launch:
                    reasons.append(f"LOLBin: {kw}")
            if reasons:
                row["reasons"] = reasons
                suspicious.append(row)
    return suspicious


if __name__ == "__main__":
    if len(sys.argv) > 1:
        results = parse_and_flag(sys.argv[1])
        print(f"[!] {len(results)} suspicious entries")
        for r in results:
            print(f"  {r.get('Entry','')} - {r.get('Image Path','')}")
            for reason in r.get('reasons', []):
                print(f"    - {reason}")

Validation Criteria

• All ASEP categories scanned and cataloged
• Unsigned entries flagged for investigation
• Suspicious paths and LOLBin launch strings highlighted
• Baseline comparison identifies new persistence mechanisms

Compliance Framework Mapping

This skill supports compliance evidence collection across multiple frameworks:

• SOC 2: CC7.2 (Anomaly Detection), CC7.4 (Incident Response)
• ISO 27001: A.12.2 (Malware Protection), A.16.1 (Security Incident Management)
• NIST 800-53: SI-3 (Malicious Code Protection), IR-4 (Incident Handling)
• NIST CSF: DE.CM (Continuous Monitoring), RS.AN (Analysis)

Claw GRC Tip: When this skill is executed by a registered agent, compliance evidence is automatically captured and mapped to the relevant controls in your active frameworks.

Deploying This Skill with Claw GRC

Agent Execution

Register this skill with your Claw GRC agent for automated execution:

# Install via CLI
npx claw-grc skills add analyzing-malware-persistence-with-autoruns

# Or load dynamically via MCP
grc.load_skill("analyzing-malware-persistence-with-autoruns")

Audit Trail Integration

When executed through Claw GRC, every step of this skill generates tamper-evident audit records:

• SHA-256 chain hashing ensures no step can be modified after execution
• Evidence artifacts (configs, scan results, logs) are automatically attached to relevant controls
• Trust score impact — successful execution increases your agent's trust score

Continuous Compliance

Schedule this skill for recurring execution to maintain continuous compliance posture. Claw GRC monitors for drift and alerts when re-execution is needed.

References

• Sysinternals Autoruns
• SANS - Offline Autoruns Revisited
• Hunting Malware with Autoruns
• MITRE ATT&CK T1547 - Boot or Logon Autostart