Skip to content
Switch branches/tags

Latest commit


Git stats


Failed to load latest commit information.
Latest commit message
Commit time

AutoRuns PowerShell Module

AutoRuns module was designed to help do live incident response and enumerate autoruns artifacts that may be used by legitimate programs as well as malware to achieve persistence.

Table of Contents


Install the module

The module is located on the PowerShellGallery

# Check the module on using PowerShellGet cmdlets
Find-Module -Name Autoruns -Repository PSGallery
Version    Name                                Repository           Description
-------    ----                                ----------           -----------                                   
13.98.1    AutoRuns                            PSGallery            AutoRuns is a module ...
# Save the module locally in Downloads folder
Save-Module -Name AutoRuns -Repository PSGallery -Path ~/Downloads

Stop and please review the content of the module, I mean the code to make sure it's trustworthy :-)

You can also verify that the SHA256 hashes of downloaded files match those stored in the catalog file

$HT = @{
    CatalogFilePath = "~/Downloads/AutoRuns/13.98.1/"
    Path = "~/Downloads/AutoRuns/13.98.1"
    Detailed = $true
    FilesToSkip = 'PSGetModuleInfo.xml'
Test-FileCatalog @HT
# Import the module
Import-Module ~/Downloads/AutoRuns/13.98.1/AutoRuns.psd1 -Force -Verbose

Check the command available

Get-Command -Module AutoRuns
CommandType     Name                                               Version    Source
-----------     ----                                               -------    ------
Function        Compare-AutoRunsBaseLine                           13.98.1    AutoRuns
Function        Get-PSAutorun                                      13.98.1    AutoRuns
Function        New-AutoRunsBaseLine                               13.98.1    AutoRuns

Find the syntax


# View the syntax of Get-PSAutorun
Get-Command Get-PSAutorun -Syntax

Get-PSAutorun [-All] [-BootExecute] [-AppinitDLLs] [-ExplorerAddons] [-ImageHijacks] [-InternetExplorerAddons] [-KnownDLLs] [-Logon] [-Winsock] [-Codecs] [-OfficeAddins] [-PrintMonitorDLLs] [-LSAsecurityProviders] [-ServicesAndDrivers] [-ScheduledTasks] [-Winlogon] [-WMI] [-PSProfiles] [-ShowFileHash] [-VerifyDigitalSignature] [-User <string>] [<CommonParameters>]

Get-PSAutorun [-All] [-BootExecute] [-AppinitDLLs] [-ExplorerAddons] [-ImageHijacks] [-InternetExplorerAddons] [-KnownDLLs] [-Logon] [-Winsock] [-Codecs] [-OfficeAddins] [-PrintMonitorDLLs] [-LSAsecurityProviders] [-ServicesAndDrivers] [-ScheduledTasks] [-Winlogon] [-WMI] [-PSProfiles] [-Raw] [-User <string>] [<CommonParameters>]


# View the syntax of New-AutoRunsBaseLine
Get-Command New-AutoRunsBaseLine -Syntax

New-AutoRunsBaseLine [-InputObject] <Object[]> [[-FilePath] <string>] [-WhatIf] [-Confirm] [<CommonParameters>]


# View the syntax of Compare-AutoRunsBaseLine
Get-Command Compare-AutoRunsBaseLine -Syntax

Compare-AutoRunsBaseLine [[-ReferenceBaseLineFile] <string>] [[-DifferenceBaseLineFile] <string>] [<CommonParameters>]

View examples provided in the help


# Get examples from the help
 Get-Help Get-PSAutorun  -Examples


    Get Autorun entries.

    -------------------------- EXAMPLE 1 --------------------------

    PS C:\>Get-PSAutorun -BootExecute -AppinitDLLs

    -------------------------- EXAMPLE 2 --------------------------

    PS C:\>Get-PSAutorun -KnownDLLs -LSAsecurityProviders -ShowFileHash

    -------------------------- EXAMPLE 3 --------------------------

    PS C:\>Get-PSAutorun -All -ShowFileHash -VerifyDigitalSignature

    -------------------------- EXAMPLE 4 --------------------------

    PS C:\>Get-PSAutorun -All -User * -ShowFileHash -VerifyDigitalSignature


# Piping the filtered output of the Get-PSAutorun to the New-AutoRunsBaseLine function will create a .ps1 file in ~/Documents
Get-PSAutorun -VerifyDigitalSignature |
Where { -not($_.isOSbinary)} |
New-AutoRunsBaseLine -Verbose

# On Windows PowerShell, you can use the Out-GridView cmdlet to run and view the content of the file created
~\Documents\PSAutoRunsBaseLine-20201102214715.ps1 |
Out-GridView -PassThru


# You need two files in ~/Documents generated by the New-AutoRunsBaseLine function
Compare-AutoRunsBaseLine -Verbose


if ($ExecutionContext.SessionState.LanguageMode -eq 'ConstrainedLanguage') {
    Get-Content -Path AWL.xml
    Set-AppLockerPolicy -XmlPolicy AWL.xml -Verbose -Merge

If your corporate admin has turned off local group policy objects processing on a domain joined device, you'll need to add the trusted publisher rule in a Domain group policy.

gp 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\System' -Name DisableLGPOProcessing -EA 0


Coding best practices

  • Use PSScriptAnalyzer module to validate the code follows best practices
  • Write Pester tests for this module

OS and Software compatibility

  • Test the module in PowerShell Core 6.x (latest)
  • Test the module in PowerShell Core 7.x (latest)
  • Test the module on Nano and get rid of Add-Member cmdlet
  • Test the module on various versions of Windows 10
    • 1709
    • 1803
    • 1809
    • 1903
    • 1909
    • 2004
    • 20H2
  • Test the module on Windows RT
  • Review Office Add-ins code with Office x86 and x64 versions

General improvements

  • Write a better implementation of the internal Get-RegValue function
  • Review and improve regex used by the internal Get-PSPrettyAutorun function (ex: external paths)

New features

  • Replace HKCU and add an option to specify what user hive is being investigated
  • Add timestamps on registry keys
  • Analyze an offline image of Windows
  • Create a baseline of artifacts
  • Compare two baselines of artifacts


  • More examples
  • Use external help?
  • Internationalization?
  • Copy the changelog at the end of the module in
  • Document issues and write a pester tests to validate the module behavior if fixed


Thanks go to:

Get-PSAutorun -VerifyDigitalSignature | ? { -not $_.IsOSBinary }

Other links

Original Autoruns.exe from Mark Russinovich

Autoruns v13.99

This update to Autoruns fixes a bug that resulted in some empty locations being hidden when the Include Empty Locations option is selected.

Autoruns v13.98

This release of Autoruns resolves an issue where Microsoft Defender binaries were being flagged as unsigned.

Autoruns v13.95

This Autoruns update adds support for user Shell folders redirections.

Autoruns v13.94

This Autoruns update fixes a bug that prevented the correct display of the target of image hosts such as svchost.exe, rundll32.exe, and cmd.exe.

Autoruns v13.93

This Autoruns update fixes a bug that prevented UserInitMprLogonScript from being scanned and by-default enables HCKU scanning for the console version.

Autoruns v13.90

Autoruns, a comprehensive Windows autostart entry point (ASEP) manager, now includes Runonce*\Depend keys and GPO logon and logoff locations, as well as fixes a bug in WMI path parsing.

Autoruns v13.82

This Autoruns release shows Onenote addins and fixes several bugs.

Autoruns v13.81

This update to Autoruns fixes a Wow64 bug in Autorunsc that could cause 32-bit paths to result in 'file not found' errors, and expands the set of images not considered part of Windows for the Windows filter in order to reveal malicious files masquerading as Windows images

Autoruns v13.80

This release of Autoruns, a utility for viewing and managing autostart execution points (ASEPs), adds additional autostart entry points, has asynchronous file saving, fixes a bug parsing 32-bit paths on 64-bit Windows, shows the display name for drivers and services, and fixes a bug in offline Virus Total scanning.

Autoruns v13.71

This update to Autoruns, a comprehensive autostart execution point manager, adds Microsoft HTML Application Host (mshta.exe) as hosting image so it displays the hosted image details, and now doesn’t apply filters to hosting images.

Autoruns v13.7

Autoruns, an autostart entry point management utility, now reports print providers, registrations in the WMI\Default namespace, fixes a KnownDLLs enumeration bug, and has improved toolbar usability on high-DPI displays.

Autoruns v13.51

This release of Autoruns, a comprehensive autostart entry manager, fixes a WMI command-line parsing bug, emits a UNICODE BOM in the file generated when saving results to a text file, and adds back the ability to selectively verify the signing status of individual entries.

Autoruns v13.5

This update to Autoruns, the most comprehensive autostart viewer and manager available for Windows, now shows 32-bit Office addins and font drivers, and enables resubmission of known images to Virus Total for a new scan.

Autoruns v13.4

Autoruns, the most comprehensive utility available for showing what executables, DLLs, and drivers are configured to automatically start and load, now reports Office addins, adds several additional autostart locations, and no longer hides hosting executables like cmd.exe, powershell.exe and others when Windows and Microsoft filters are in effect.

Autoruns v13.3

Autoruns, a utility that shows what processes, DLLs, and drivers are configured to automatically load, adds reporting of GP extension DLLs and now shows the target of hosting processes like cmd.exe and rundll32.exe.

Autoruns v13.2

In addition to bug fixes to CSV and XML output, Autorunsc introduces import-hash reporting, and Autoruns now excludes command-line and other host processes from the Microsoft and Windows filters.

Autoruns v13.01

This release fixes a bug in v13 that caused autostart entry lines not to show when you enter a filter string into the toolbar's filter control

Autoruns v13.0

This major update to Autoruns, an autostart execution point (ASEP) manager, now has integration with to show the status of entries with respect to scans by over four dozen antimalware engines. It also includes a revamped scanning architecture that supports dynamic filters, including a free-form text filter, a greatly improved compare feature that highlights not just new items but deleted ones as well, and file saving and loading that preserves all the information of a scan

Autoruns v12.03

This update to Autoruns adds the registered HTML file extension, fixes a bug that could cause disabling of specific entry types to fail with a “path not found” error, and addresses another that could prevent the Jump-to-image function from opening the selected image on 64-bit Windows.

Autoruns v12.02

This fixes a bug that could cause Autoruns to crash on startup, updates the image path parsing for Installed Components to remove false positive file-not-found entries, and correctly reports image entry timestamps in local time instead of UTC.

Autoruns v12.01

This update to Autoruns, a utility that comes in Windows application and command-line forms, has numerous bug fixes, adds a profile attribute/column to CSV and XML output, and interprets the CodeBase value for COM object registrations.

Autoruns v12.0

This release of Autoruns, a Windows application and command-line utility for viewing autostart entries, now reports the presence of batch file and executable image entries in the WMI database, a vector used by some types of malware.

Autoruns v11.70

This release of Autoruns, a powerful utility for scanning and disabling autostart code, adds a new option to have it show only per-user locations, something that is useful when analyzing the autostarts of different accounts than the one that Autoruns is running under.

Autoruns v11.62

This release fixes a bug in version 11.61’s jump-to-image functionality.


🚀AutoRuns is a module that will help do live incident response and enumerate autoruns artifacts that may be used by legitimate programs as well as malware to achieve persistence.




No packages published