Autoruns Resources

USE what Autoruns detects: https://www.microsoftpressstore.com/articles/article.aspx?p=2762082&seqNum=2

http://pwnwiki.io/#!persistence/windows/autostart.md

https://threatvector.cylance.com/en_us/home/windows-registry-persistence-part-2-the-run-keys-and-search-order.html

https://www.peerlyst.com/posts/list-of-autorun-keys-malware-persistence-windows-registry-entries-benjamin-infosec

Best Resources collected from Twitter ask:

• https://github.com/tomchop/volatility-autoruns/blob/master/autoruns.py
• https://silentrunners.org/launchpoints.html
• https://journeyintoir.blogspot.com/2013/03/tracking-down-persistence-mechanisms.html
• http://www.hexacorn.com/blog/2017/01/28/beyond-good-ol-run-key-all-parts/
• Opening up Autoruns and exporting the list it checks!