Malware Persistence Analysis with Autoruns

This skill empowers security analysts and AI agents to systematically hunt for malware persistence on Windows environments. By leveraging Sysinternals Autoruns, it scans over 18 categories of Auto-Start Extensibility Points (ASEPs), including registry keys, scheduled tasks, and WMI subscriptions. It streamlines the investigation process by automatically flagging unsigned binaries, suspicious file paths, and Living-off-the-Land Binaries (LOLBins), while supporting baseline comparisons to isolate newly added persistence entries during incident response.

主な機能

ユースケース