Autorun collector

The Autorun collector returns the autorun entries for a Windows-managed device.

Collector output

Field	Type	Description
entry_timestamp	String	Last modification time of the autorun entry location. It can be a folder, registry key, or scheduled tasks.
entry_location	String	The entry location of the autorun entry. It can be a folder, registry key, or scheduled tasks.
entry	String	The name of the entry. It can be the name of the shortcut, registry key name, or task full name.
enabled	String	Indicates if the entry is active.
category	String	Specifies the category of the entry. The possible values are: Logon, Explorer, Internet Explorer, Tasks, Codecs, Image Hijack, AppInit Dlls, Known DLLs, Boot Execute, WinLogon, Print Monitors, LSA Providers, Network Providers, Office).
Profile	String	Profile indicates the user mode under which we discovered the entry. The possible values are: Logged-on user name, System-wide.
Description	String	The description member of the version data for the file associated with the entry.
Publisher	String	The publisher member of the version data for the file associated with the entry.
image_path	String	The file path for the file associated with the entry.
Version	String	The version member of the version data for the file associated with the entry.
launch_string	String	The command line with which the file was launched for this entry.

Supported versions

Windows	Linux	macOS
3.0 and later	n/a	n/a

Example: Show autorun entries for Task Scheduler

AutoRun where AutoRun entry_location equals "Task Scheduler"

Which categories of autorun entries exist

AutoRun entry, entry_location, image_path, category, enabled

Filter by exclusion - by single field with many matches

AutoRun entry, entry_location, image_path, category, enabled
    WHERE AutoRun category not equals "Explorer"
        AND AutoRun category not equals "Codecs"
        AND AutoRun category not equals "Logon"
        AND AutoRun category not equals "Tasks"
        AND AutoRun category not equals "Print Monitors"
        AND AutoRun category not equals "LSA Providers"
        AND AutoRun category not equals "Known DLLs"
        AND AutoRun category not equals "Network Providers"

Filter by exclusion - by many fields

AutoRun entry, entry_location, image_path, category, enabled
    WHERE AutoRun enabled not equals "enabled"
        AND AutoRun image_path contains "C:\Users"
        AND AutoRun image_path ends with ".exe"
            AND AutoRun category not equals "Explorer"
            AND AutoRun category not equals "Codecs"
            AND AutoRun category not equals "Logon"
            AND AutoRun category not equals "Tasks"
            AND AutoRun category not equals "Print Monitors"
            AND AutoRun category not equals "LSA Providers"
            AND AutoRun category not equals "Known DLLs"
            AND AutoRun category not equals "Network Providers"

Which entries exist for the explorer autorun

AutoRun entry, entry_location, image_path, category
    WHERE AutoRun category equals "Explorer"

Which entries exist for the logon autorun

AutoRun entry, entry_location, image_path, category
    WHERE AutoRun category equals "Logon"

Which entries exist for the tasks autorun

AutoRun entry, entry_location, image_path, category
    WHERE AutoRun category equals "Tasks"

Specify tasks that launch with exe files

AutoRun  category, entry, entry_location, image_path, launch_string, description
    WHERE AutoRun category equals "Tasks"
        AND AutoRun image_path ends with ".exe"

Specify tasks that launch with exe files - from user space

AutoRun  category, entry, entry_location, image_path, launch_string, description
    WHERE AutoRun category equals "Tasks"
        AND AutoRun image_path ends with ".exe"
            AND AutoRun image_path contains "C:\Users\"

Specify tasks that launch with exe files - by description

AutoRun  category, entry, entry_location, image_path, launch_string, description
    WHERE AutoRun category equals "Tasks"
        AND AutoRun image_path ends with ".exe"
            AND AutoRun description equals "FakeGoogle Installer"