$ show p0w3rsh3ll/AutoRuns
AutoRuns is a PowerShell module for live incident response that enumerates Windows autorun artifacts used by legitimate programs and malware to achieve persistence. It scans over 20 categories of autostart execution points (ASEPs) including registry keys (Run, RunOnce, BootExecute, AppInit, etc.), file system locations (Startup folders), scheduled tasks, WMI subscriptions, services and drivers, Office addins, and more. The module provides three main functions: Get-PSAutorun to collect artifacts, New-AutoRunsBaseLine to create a baseline snapshot, and Compare-AutoRunsBaseLine to compare two baselines for change detection. It supports optional file hashing (MD5, SHA1, SHA256) and digital signature verification via Get-AuthenticodeSignature. The architecture is a single PowerShell script module (AutoRuns.psm1) with internal helper functions for registry reading, path normalization, and command-line parsing. It relies solely on PowerShell 4.0+ and Windows built-in APIs, with no external dependencies. The module is designed for forensic analysts and incident responders to quickly identify persistence mechanisms on a live Windows system.
The LLM identified 3 files worth highlighting for reuse:
The main PowerShell module that implements the entire autoruns enumeration logic. It contains three exported functions (Get-PSAutorun, New-AutoRunsBaseLine, Compare-AutoRunsBaseLine) and numerous internal helpers for reading registry, parsing command lines, normalizing paths, and computing file hashes. The module is self-contained, well-documented, and follows PowerShell best practices. It can be imported into any PowerShell session on Windows to perform live forensic analysis of autostart mechanisms.
A self-contained PowerShell function that normalizes file system paths, handling UNC paths, 8.3 short names, and provider prefixes. It resolves relative paths, removes redundant components, and can optionally prefix with 'FileSystem::'. This function is independent of the rest of the module and can be extracted and reused in any PowerShell project requiring robust path resolution.
A novel testing pattern that uses PowerShell's Abstract Syntax Tree (AST) to extract functions from a module and load them into a fake module for isolated unit testing. This allows testing internal functions without loading the full module, avoiding side effects. The pattern is implemented in the test file's preamble and is reusable for testing any PowerShell module that needs to test internal functions in isolation.