Run and Run
Programs started at every logon, for all users (HKLM) or for one user (HKCU).
Use it to find programs set to start at every logon, the most common way malware survives a restart.
- SOFTWARE
- Persistence
What It Is
The Run and RunOnce keys are the simplest way to make a program start when a user logs on. Each value under a Run key is a command, and Windows runs every one each time a user logs on. RunOnce works the same way but deletes each value once it has run. The keys sit both in SOFTWARE, for every user, and in each user's own NTUSER.DAT, so a program can be set to start for one user or for all. They are one of the first places to check when something keeps coming back after a restart.
What It Proves
The value is set, so its command runs when a user logs on. The key's last write time dates the newest change.
What It Does Not Prove
It shows what is set now, not whether it ran or who added it. The values have no time of their own, and RunOnce values delete themselves once they run.
Where It Lives
Run and RunOnce Keys lives in the SOFTWARE hive, which holds settings for the whole machine. Offline Hive shows the path inside the hive file, as Registry Explorer opens it, and Live System shows the same key as regedit shows it on a running machine. The line under the path is where the hive file sits on disk.
SOFTWARE\C:\What It Looks Like
These are three values from this key on ws-042, the fictional machine the wiki follows, decoded into plain English. Each row shows the value as Windows stores it, its name, type and data, then what it tells you.
| Registry Value | What It Tells You |
|---|---|
| Starts the Windows Security tray icon at each logon, a standard Windows entry. Knowing the normal entries makes the odd ones stand out. |
| In alice's own Run key (HKCU), odupd |
| Hidden, encoded PowerShell is set to run at every logon, a common shape of an implant. Decode the Base64 to see what it runs, and date the change from the key's last write time. |
How to Read It
Check Run and RunOnce in SOFTWARE, SOFTWARE\WOW6432Node and every user's NTUSER.DAT. Look for odd names, paths in Temp, AppData or ProgramData, and script hosts such as powershell or mshta. The key last write time dates only the most recent change in that key.
- When Windows Writes It
- Windows writes it when software, a user or an attacker adds or changes a value, and removes RunOnce values as they run.
- Which Windows Versions
- Windows XP to 11
- Tools That Parse It
- Autoruns, Registry Explorer, RegRipper (run)
Hunt It
The live tools that record Registry writes catch a new autorun as it is set, within the time they keep, but the value set before then sits only in the hive. A process creation record shows the command actually running at logon, which the value alone cannot.
Defender records autorun writes like these. It shows changes inside your retention window, not values set before it.
// Values written to Run and RunOnce, with the process that wrote themDeviceRegistryEvents| where Timestamp > ago(Confirm It With
One artefact can mislead on its own. These other records show the same activity, or pin down when it happened, so use them to back up what Run and RunOnce Keys shows.
- AmcacheGives the SHA-1 of the program the value starts, to check it against threat intelligence.
- Process Starts at Logon, Security Event 4688Not in the RegistryShows the command actually ran at logon, and under which account.
- Prefetch FilesNot in the RegistryShows the program ran and dates its recent runs, which the value cannot.
Sources
The facts on this page come from these public pages, which say more on each point.