WOW6432Node Run and RunOnce

The Run and RunOnce keys 32 bit programs see on a 64 bit machine, easy to miss.

Use it to find programs set to start at logon in the 32 bit view of the Run keys, which a check of one view misses.

SOFTWARE
Persistence

What It Is

The Run and RunOnce keys list programs Windows starts when a user signs in, with Run entries starting at every sign-in and RunOnce entries starting once and then being removed. On 64-bit Windows the registry redirector gives 32-bit programs a separate view of HKLM SOFTWARE, physically stored under the Wow6432Node subkey. This is the Run location those 32-bit programs see, and the redirection is transparent to the program.

What It Proves

A value here runs at logon for 32 bit programs, which read the WOW6432Node view of SOFTWARE. It is a separate key from the 64 bit Run, so a review that checks only one view misses it.

What It Does Not Prove

Shows what is set now, not whether it ran or who added it. On 32 bit Windows there is no WOW6432Node, so the plain Run key is the only one.

Where It Lives

WOW6432Node Run and RunOnce lives in the SOFTWARE hive, which holds settings for the whole machine. Offline Hive shows the path inside the hive file, as Registry Explorer opens it, and Live System shows the same key as regedit shows it on a running machine. The line under the path is where the hive file sits on disk.

SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run

C:\Windows\System32\config\SOFTWARE

What It Looks Like

These are two values from this key on ws-042, the fictional machine the wiki follows, decoded into plain English. Each row shows the value as Windows stores it, its name, type and data, then what it tells you.

Values in WOW6432Node Run and RunOnce, each with what it tells you
Registry Value	What It Tells You
`Adobe CCXProcess` `REG_SZC:\Program Files (x86)\Adobe\Adobe Creative Cloud Experience\CCXProcess.exe`	Adobe's Creative Cloud helper starts at logon from this 32 bit view, out of Program Files (x86). A vendor file there is normal, but confirm its Adobe signature.
`RunOnce (WOW6432Node)` `SubkeyNo values`	The 32 bit RunOnce key is empty, so nothing is queued for the next logon. Its values delete themselves, so check Defender or Sysmon data for past ones.

How to Read It

Look under SOFTWARE\WOW6432Node for Run and RunOnce, the view 32 bit code is given. Compare it with the 64 bit Run key, because attackers use the less watched view. Treat paths in Temp, AppData or ProgramData and script hosts as high priority.

When Windows Writes It: It is written when a 32 bit installer, a user or an attacker adds a value. RunOnce values delete themselves as they run.
Which Windows Versions: 64 bit Windows 7 to 11
Tools That Parse It: Autoruns, Registry Explorer, RegRipper (run)

Hunt It

Sees It DirectlyDeviceRegistryEvents

Defender records these writes within retention. It shows the change, not whether the command ran.

KQLDefender XDR, Advanced hunting

// Autorun writes under the WOW6432Node Run and RunOnce keysDeviceRegistryEvents| where Timestamp > ago(30d)| where DeviceName startswith "ws-042"| where ActionType == "RegistryValueSet"| where RegistryKey has "WOW6432Node" and (RegistryKey endswith @"\CurrentVersion\Run" or RegistryKey endswith @"\CurrentVersion\RunOnce")| project Timestamp, RegistryKey, RegistryValueName, RegistryValueData, InitiatingProcessCommandLine| order by Timestamp desc

Confirm It With

One artefact can mislead on its own. These other records show the same activity, or pin down when it happened, so use them to back up what WOW6432Node Run and RunOnce shows.

Run and RunOnce KeysIt is the 64 bit view of the same autostart. Check both, as a review of one misses the other.
AmcacheGives the SHA-1 of the program the value starts.
Process Starts at Logon, Security Event 4688Not in the RegistryShows the command ran at logon, and under which account.

Sources

The facts on this page come from these public pages, which say more on each point.