Enumerate Windows Autorun / Run Keys
DFIR triage: dump the common registry autostart locations where malware plants persistence.
# per-user and machine-wide Run / RunOnce keys
$paths = @(
'HKLM:\Software\Microsoft\Windows\CurrentVersion\Run',
'HKLM:\Software\Microsoft\Windows\CurrentVersion\RunOnce',
'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run'
)
foreach ($p in $paths) {
Get-ItemProperty -Path $p -ErrorAction SilentlyContinue |
Select-Object -Property * -ExcludeProperty PS*
}