{"id":1681,"date":"2016-02-21T08:49:07","date_gmt":"2016-02-21T13:49:07","guid":{"rendered":"http:\/\/swildow.darktech.org\/wp\/?p=1681"},"modified":"2016-02-21T08:49:07","modified_gmt":"2016-02-21T13:49:07","slug":"powershell-malware-detection-and-tracking-of-new-autoruns","status":"publish","type":"post","link":"https:\/\/www.wildow.com\/blog\/?p=1681","title":{"rendered":"PowerShell: Malware detection and tracking of new autoruns"},"content":{"rendered":"

PowerShell: Malware detection and tracking of new autoruns<\/a><\/h3>\n
\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"<\/span><\/div>\n
\"Robin<\/span>Robin Granberg<\/a>\u00a0<\/span><\/span><\/span><\/div>\n
20 Feb 2016 2:35 AM\u00a0<\/span><\/span><\/div>\n
\n

Old Project realized<\/h2>\n

A month ago I reinstalled one of my PC’s and thought of a project I started but never finished many years ago. It was when I found out about autorunsc.exe , one of the many awesome tools from the\u00a0<\/span>Sysinternals suite<\/strong>\u00a0<\/span>and the creatorMark Russinovich<\/strong>, when I thought of an idea to\u00a0<\/span>keep track of all additions to my Windows installation<\/strong>. Any additions to it that had any effect on my boot process or that started any processes at startup. With this information I would be able to determine when I had additions I didn\u2019t approved nor expected.\u00a0 Then I could simple remove these binaries or uninstall the guilty application.<\/p>\n

Now, I have a slightly different approach<\/strong>. Besides catching all additions to the auto-runs in my Windows installation\u00a0<\/span>I also would like to know what executables are signed or not and if these could be a threat to me<\/strong>. I’m thinking of malware and vicious code. I think autorunsc.exe can do a fantastic job here with all its features, especially with some of the new features and the combination with another awesome tool, also from Sysinternals, Sigcheck.<\/p>\n

Some\u00a0 of the\u00a0 things Autorunsc do:<\/strong><\/p>\n