Command Processor AutoRun

A command cmd.exe runs automatically each time it starts, unless started with /D.

Use it to find a command that runs every time cmd.exe starts, for one user or for everyone on the machine.

SOFTWARE
Persistence

What It Is

The Command Processor key holds settings for cmd.exe, the Windows command interpreter. Its AutoRun value names a command that cmd.exe runs automatically each time it starts, before any other command, unless cmd is started with the /d switch that disables AutoRun. The value can be set per machine in HKLM SOFTWARE or per user in the user's hive. The same key also holds options such as EnableExtensions, DelayedExpansion and CompletionChar.

What It Proves

An AutoRun value here is run by cmd.exe whenever it starts, unless started with the autorun switch off. Because scripts and tools spawn cmd.exe constantly, it fires often.

What It Does Not Prove

It only triggers cmd.exe, not other shells. The HKCU copy takes effect for that user, and the HKLM copy for everyone.

Where It Lives

Command Processor AutoRun lives in the SOFTWARE hive, which holds settings for the whole machine. Offline Hive shows the path inside the hive file, as Registry Explorer opens it, and Live System shows the same key as regedit shows it on a running machine. The line under the path is where the hive file sits on disk.

SOFTWARE\Microsoft\Command Processor

C:\Windows\System32\config\SOFTWARE

What It Looks Like

These are two values from this key on ws-042, the fictional machine the wiki follows, decoded into plain English. Each row shows the value as Windows stores it, its name, type and data, then what it tells you.

Values in Command Processor AutoRun, each with what it tells you
Registry Value	What It Tells You
`AutoRun (HKLM)` `REG_SZ(not present)`	The machine AutoRun value is not set, so cmd.exe runs nothing extra for any user. A script or executable path here would run on every shell.
`AutoRun (HKCU, alice)` `REG_SZ(not present)`	alice's hive has no AutoRun value either, so nothing extra runs when she opens cmd.exe. Check the support account's hive too, as each user has a copy.

How to Read It

Read AutoRun under Command Processor in HKLM and in each user NTUSER.DAT. The data is a command line run before the requested command. A path to a script or a hidden executable is the sign. The value is empty by default.

When Windows Writes It: When a user or an attacker writes the AutoRun value.
Which Windows Versions: Windows XP to 11
Tools That Parse It: Autoruns, Registry Explorer, RECmd

Hunt It

Sees It DirectlyDeviceRegistryEvents

Defender records these writes within retention. A hit shows the value being set, not that cmd.exe has run it since.

KQLDefender XDR, Advanced hunting

// AutoRun written under Command ProcessorDeviceRegistryEvents| where Timestamp > ago(30d)| where DeviceName startswith "ws-042"| where RegistryKey has "Command Processor" and RegistryValueName =~ "AutoRun"| project Timestamp, ActionType, RegistryKey, RegistryValueData, InitiatingProcessCommandLine

Confirm It With

One artefact can mislead on its own. These other records show the same activity, or pin down when it happened, so use them to back up what Command Processor AutoRun shows.

AmcacheGives the SHA-1 of a program the AutoRun command starts.
cmd.exe Starts a Child, Security Event 4688Not in the RegistryShows the AutoRun command running each time cmd.exe starts.

Sources

The facts on this page come from these public pages, which say more on each point.