{
  "family": "autoruns",
  "sample_count": 21,
  "category": "hacktool",
  "description": "AutoRuns (tracked in antimalware telemetry under signatures including HackTool:Win32/AutoRuns, VirTool:Win32/AutoRuns, and Trojan:Win32/AutoRuns) refers to weaponized, trojanized, or unauthorized redistributions of autostart enumeration and manipulation utilities. While legitimate Sysinternals Autoruns is an industry-standard administrative utility, threat actors frequently recompile, wrap, or trojanize the tool to automate persistence auditing, locate and displace competitor malware on compromised systems, and forcibly install malicious services or registry run keys during lateral movement campaigns. Weaponized variants often incorporate embedded shellcode droppers, obfuscated command-line wrappers, or anti-EDR evasion hooks to hide unauthorized autorun modifications from security operations center (SOC) analysts.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "HackTool:Win32/AutoRuns",
    "VirTool:Win32/AutoRuns",
    "Trojan:Win32/AutoRuns",
    "Win32/AutoRuns",
    "Tool:Win32/AutoRuns"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is HackTool:Win32/AutoRuns?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "HackTool:Win32/AutoRuns detects weaponized or trojanized versions of the Sysinternals Autoruns tool used maliciously by attackers."
      }
    },
    {
      "@type": "Question",
      "name": "How do adversaries misuse Autoruns utilities?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Adversaries use it to discover existing persistence mechanisms, eliminate competitor malware, and audit system autostart locations."
      }
    },
    {
      "@type": "Question",
      "name": "How does weaponized Autoruns differ from legitimate Sysinternals tools?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Weaponized versions embed malicious loaders, obfuscated wrappers, or shellcode execution hooks."
      }
    },
    {
      "@type": "Question",
      "name": "What persistence mechanisms are audited or modified by the tool?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It inspects and modifies Registry Run keys, Windows Services, Scheduled Tasks, Winlogon handles, and driver registrations."
      }
    },
    {
      "@type": "Question",
      "name": "How can unauthorized use of Autoruns be detected and controlled?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Enforce application allowlisting via AppLocker/WDAC, restrict admin execution privileges, and monitor process creation events."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1547.001",
    "T1543.003",
    "T1082",
    "T1027",
    "T1059.003"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - HackTool:Win32/AutoRuns",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=HackTool:Win32/AutoRuns"
    },
    {
      "name": "Microsoft Learn - Sysinternals Autoruns Documentation",
      "url": "https://learn.microsoft.com/en-us/sysinternals/downloads/autoruns"
    },
    {
      "name": "Trend Micro Threat Encyclopedia - HackTool.Win32.AutoRuns",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/hacktool.win32.autoruns"
    }
  ],
  "mitre_attack_detail": [
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    },
    {
      "id": "T1543.003",
      "name": "Create or Modify System Process: Windows Service",
      "tactic": "Persistence"
    },
    {
      "id": "T1082",
      "name": "System Information Discovery",
      "tactic": "Discovery"
    },
    {
      "id": "T1027",
      "name": "Obfuscated Files or Information",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1059.003",
      "name": "Command and Scripting Interpreter: Windows Command Shell",
      "tactic": "Execution"
    }
  ],
  "containment_steps": [
    "Terminate unauthorized instances of autorun auditing or manipulation executables.",
    "Verify the digital signature of Autoruns utilities to distinguish legitimate Sysinternals binaries from repackaged hacktools.",
    "Audit Windows Run registry entries, scheduled tasks, and services for unauthorized modifications.",
    "Deploy AppLocker or Windows Defender Application Control (WDAC) to enforce application whitelisting.",
    "Isolate machines where unauthorized hacktools have been executed to evaluate post-exploitation activity."
  ],
  "what_to_avoid": [
    "Do not allow arbitrary unsigned administrative utilities to run with elevated privileges.",
    "Do not assume all Autoruns executions are benign administrative activities without corroborating with IT operations."
  ],
  "target_industries": [
    "Enterprise Networks",
    "Financial Institutions",
    "Government",
    "Critical Infrastructure"
  ],
  "target_geographies": [
    "Global"
  ],
  "threat_actors": [
    "Advanced Threat Groups & Post-Exploitation Operators"
  ],
  "attack_stage": [
    "discovery",
    "persistence",
    "privilege_escalation"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "motivation": "System Reconnaissance, Persistence Manipulation & Lateral Movement",
  "sample_hashes": [],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 7"
  ]
}