AutoRuns is a PowerShell module for live incident response that enumerates Windows autorun artifacts used by legitimate programs and malware to achieve persistence. It scans over 20 categories of autostart execution points (ASEPs) including registry keys (Run, RunOnce, BootExecute, AppInit, etc.), file system locations (Startup folders), scheduled tasks, WMI subscriptions, services and drivers, Office addins, and more. The module provides three main functions: Get-PSAutorun to collect artifacts, New-AutoRunsBaseLine to create a baseline snapshot, and Compare-AutoRunsBaseLine to compare two baselines for change detection. It supports optional file hashing (MD5, SHA1, SHA256) and digital signature verification via Get-AuthenticodeSignature. The architecture is a single PowerShell script module (AutoRuns.psm1) with internal helper functions for registry reading, path normalization, and command-line parsing. It relies solely on PowerShell 4.0+ and Windows built-in APIs, with no external dependencies. The module is designed for forensic analysts and incident responders to quickly identify persistence mechanisms on a live Windows system.