• Manufacturer: Microsoft
  • Version: 13.98
  • Website: https://technet.microsoft.com/en-us/sysinternals/bb963902.aspx

Description

Autoruns reports Explorer shell extensions, toolbars, browser helper objects, Winlogon notifications, auto-start services, etc.at is provided as part of the Windows Sysinternals suite of tools. It collects system information while running in the background and supports storing it in the Windows Event Log.

Data Model Coverage

file

  company content creation_time file_extension file_gid file_group file_name file_path file_uid file_user fqdn hostname image_path link_target md5_hash mime_type mode pid ppid previous_creation_time sha1_hash sha256_hash signature_valid signer uid user
acl_modify                                                    
create                              
delete                                                    
modify                              
read                                                    
timestomp                                                    
write                                                    

registry

  data fqdn hive hostname image_path key new_content pid type user value
add        
key_edit      
remove                      
value_edit      

service

  command_line exe fqdn hostname image_path name pid ppid uid user
create        
delete        
pause                    
start                    
stop                    

Analytic Coverage