{"id":13511108,"url":"https://github.com/tomchop/volatility-autoruns","last_synced_at":"2025-03-26T14:32:04.696Z","repository":{"id":21221223,"uuid":"24535291","full_name":"tomchop/volatility-autoruns","owner":"tomchop","description":"Autoruns plugin for the Volatility framework","archived":false,"fork":false,"pushed_at":"2019-07-18T19:36:33.000Z","size":91,"stargazers_count":121,"open_issues_count":5,"forks_count":20,"subscribers_count":15,"default_branch":"master","last_synced_at":"2025-03-21T23:24:03.104Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"gpl-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/tomchop.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2014-09-27T15:30:19.000Z","updated_at":"2025-02-26T13:28:31.000Z","dependencies_parsed_at":"2022-08-31T02:51:48.147Z","dependency_job_id":null,"html_url":"https://github.com/tomchop/volatility-autoruns","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tomchop%2Fvolatility-autoruns","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tomchop%2Fvolatility-autoruns/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tomchop%2Fvolatility-autoruns/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tomchop%2Fvolatility-autoruns/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/tomchop","download_url":"https://codeload.github.com/tomchop/volatility-autoruns/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":245670840,"owners_count":20653435,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-08-01T03:00:34.636Z","updated_at":"2025-03-26T14:32:04.409Z","avatar_url":"https://github.com/tomchop.png","language":"Python","funding_links":[],"categories":["Volatility plugins","Volatility 2","\u003ca id=\"4d2a33083a894d6e6ef01b360929f30a\"\u003e\u003c/a\u003eVolatility","others"],"sub_categories":["Plugins"],"readme":"# Volatility autoruns plugin\n\n[![Build Status](https://travis-ci.com/tomchop/volatility-autoruns.svg?branch=master)](https://travis-ci.com/tomchop/volatility-autoruns)\n\n\n\nFinding persistence points (also called \"Auto-Start Extensibility Points\", or ASEPs) is a recurring task of any investigation potentially involving malware.\n\nTo make an analyst's life a bit easier, I came up with the `autoruns` plugin. `autoruns` basically automates most of the tasks you would need to run when trying to find out where malware is persisting from. Once all the autostart locations are found, they are matched with running processes in memory.\n\n## How-to\n\nThe plugin is pretty straightforward to use. The folder where the plugin is located should be passed on to Volatility using the `--plugins=` parameter.\n\nRelevant options for the plugin are:\n\n* `-v` or `--verbose` - Shows extra information that would normally be filtered (like Services from the System32 folder)\n* `-t` or `--asep-type=[autoruns|services|appinit|winlogon|tasks|activesetup]` - Use it to focus on specific ASEPS. Options are: `autoruns` (Run, RunOnce, etc.), `services`, `appinit`, `winlogon`, `tasks`, and `activesetup`. You can specify any combination of them with a comma-separated list: `autoruns,services`. Leave blank to get all ASEPs.\n* `--output=[text|table|json]` - table will output the text in a table format (less readable but somehow more consice). The default output mode is text, where more information is avialable. json option produces the unified json output format. \n\n## Roadmap\n\n* Extra ASEPs: Scheduled tasks (done!), Startup folders\n* OS X / Linux support\n* Performance optimizations\n\n## ASEPs list\n\n**Software hive**\n\n* Microsoft\\Windows\\CurrentVersion\\Run,\n* Microsoft\\Windows\\CurrentVersion\\RunOnce,\n* Microsoft\\Windows\\CurrentVersion\\RunServices,\n* Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run,\n* Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Run,\n* Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\RunOnce,\n* Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run,\n* Microsoft\\Windows NT\\CurrentVersion\\Terminal Server\\Install\\Software\\Microsoft\\Windows\\CurrentVersion\\Run,\n* Microsoft\\Windows NT\\CurrentVersion\\Terminal Server\\Install\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\n\n**NTUSER.DAT hives**\n\n* Software\\Microsoft\\Windows\\CurrentVersion\\Run,\n* Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce,\n* Software\\Microsoft\\Windows\\CurrentVersion\\RunServices,\n* Software\\Microsoft\\Windows\\CurrentVersion\\RunServicesOnce,\n* Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run,\n* Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server\\Install\\Software\\Microsoft\\Windows\\CurrentVersion\\Run,\n* Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server\\Install\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce,\n* Software\\Microsoft\\Windows NT\\CurrentVersion\\Run,\n* Software\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run,\n* Software\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Run\n\n**Winlogon \u0026 AppInit**\n\n* Microsoft\\Windows NT\\CurrentVersion\\Winlogon (value AppInit_DLLs)\n* Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Notify\n* Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Notify\n* Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Userinit\n* Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\VmApplet\n* Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Shell\n* Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\TaskMan\n* Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\System\n\n**Services**\n\n* CurrentControlSet\\Services\n\n**Scheduled Tasks**\n\n* C:\\Windows\\System32\\Tasks\\ (Windows Vista and onwards only)\n\n**Active Setup**\n\n* Microsoft\\Active Setup\\Installed Components\n\n**Microsoft Fix-it**\n\n* Microsoft\\Windows NT\\CurrentVersion\\AppCompatFlags\\InstalledSDB\n\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ftomchop%2Fvolatility-autoruns","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Ftomchop%2Fvolatility-autoruns","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ftomchop%2Fvolatility-autoruns/lists"}