Enumerate Windows Autorun / Run Keys

2026-08-06 powershell blue-team forensics

DFIR triage: dump the common registry autostart locations where malware plants persistence.

powershell

# per-user and machine-wide Run / RunOnce keys
$paths = @(
  'HKLM:\Software\Microsoft\Windows\CurrentVersion\Run',
  'HKLM:\Software\Microsoft\Windows\CurrentVersion\RunOnce',
  'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run'
)
foreach ($p in $paths) {
  Get-ItemProperty -Path $p -ErrorAction SilentlyContinue |
    Select-Object -Property * -ExcludeProperty PS*
}