analyzing-malware-persistence-with-autoruns

Name: analyzing-malware-persistence-with-autoruns
Author: killvxk

34stars9forks

How to install analyzing-malware-persistence-with-autoruns?

killvxk/cybersecurity-skills-zh/analyzing-malware-persistence-with-autoruns

$npx -y skills add killvxk/cybersecurity-skills-zh --skill analyzing-malware-persistence-with-autoruns

Installs into the current project.

Summary

使用 Sysinternals Autoruns 系统化识别和分析 Windows 系统上注册表键、计划任务、服务、驱动程序和启动位置中的恶意软件持久化机制。

Files · 1

View on GitHub

SKILL.md

1	# 使用 Autoruns 分析恶意软件持久化
2
3	## 概述
4
5	Sysinternals Autoruns 从 Windows 上的数百个自动启动扩展点（ASEP）提取数据，扫描 18 个以上类别，包括 Run/RunOnce 键、服务、计划任务、驱动程序、Winlogon 条目、LSA 提供程序、打印监视器、WMI 订阅和 AppInit DLL。数字签名验证过滤 Microsoft 签名条目。比较功能通过基线差异识别新增的持久化机制。VirusTotal 集成检查哈希信誉。通过 -z 标志进行离线分析，支持取证磁盘镜像检查。
6
7	## 前置条件
8
9	- Sysinternals Autoruns（GUI）和 Autorunsc（CLI）
10	- 目标系统上的管理员权限
11	- Python 3.9+，用于自动化分析
12	- VirusTotal API 密钥，用于信誉检查
13	- 干净的基线导出，用于比对
14
15	## 操作步骤
16
17	### 步骤 1：自动化持久化扫描
18
19	```python
20	#!/usr/bin/env python3
21	"""自动化基于 Autoruns 的持久化分析。"""
22	import subprocess
23	import csv
24	import json
25	import sys
26
27
28	def scan_and_analyze(autorunsc_path="autorunsc64.exe", csv_path="scan.csv"):
29	cmd = [autorunsc_path, "-a", "", "-c", "-h", "-s", "-nobanner", ""]
30	result = subprocess.run(cmd, capture_output=True, text=True, timeout=600)
31	with open(csv_path, 'w') as f:
32	f.write(result.stdout)
33	return parse_and_flag(csv_path)
34
35
36	def parse_and_flag(csv_path):
37	suspicious = []
38	with open(csv_path, 'r', errors='replace') as f:
39	for row in csv.DictReader(f):
40	reasons = []
41	signer = row.get("Signer", "")
42	if not signer or signer == "(Not verified)":
43	reasons.append("未签名的二进制文件")
44	if not row.get("Description") and not row.get("Company"):
45	reasons.append("缺少元数据")
46	path = row.get("Image Path", "").lower()
47	for sp in ["\temp\\", "\appdata\local\temp", "\users\public\\"]:
48	if sp in path:
49	reasons.append(f"可疑路径")
50	launch = row.get("Launch String", "").lower()
51	for kw in ["powershell", "cmd /c", "wscript", "mshta", "regsvr32"]:
52	if kw in launch:
53	reasons.append(f"LOLBin：{kw}")
54	if reasons:
55	row["reasons"] = reasons
56	suspicious.append(row)
57	return suspicious
58
59
60	if __name__ == "__main__":
61	if len(sys.argv) > 1:
62	results = parse_and_flag(sys.argv[1])
63	print(f"[!] {len(results)} 个可疑条目")
64	for r in results:
65	print(f" {r.get('Entry','')} - {r.get('Image Path','')}")
66	for reason in r.get('reasons', []):
67	print(f" - {reason}")
68	```
69
70	## 验证标准
71
72	- 扫描并记录所有 ASEP 类别
73	- 标记未签名条目以供调查
74	- 突出显示可疑路径和 LOLBin 启动字符串
75	- 基线比较识别新的持久化机制
76
77	## 参考资料
78
79	- [Sysinternals Autoruns](https://learn.microsoft.com/en-us/sysinternals/downloads/autoruns)
80	- [SANS - 重新审视离线 Autoruns](https://www.sans.org/blog/offline-autoruns-revisited-auditing-malware-persistence/)
81	- [使用 Autoruns 猎捕恶意软件](https://nasbench.medium.com/hunting-malware-with-windows-sysinternals-autoruns-19cbfe4103c2)
82	- [MITRE ATT&CK T1547 - 启动或登录自动启动](https://attack.mitre.org/techniques/T1547/)

People who liked this also viewed

6 picks

Type

analyzing-malware-persistence-with-autoruns

34stars9forks

View on GitHub

How to install analyzing-malware-persistence-with-autoruns?

killvxk/cybersecurity-skills-zh/analyzing-malware-persistence-with-autoruns

$npx -y skills add killvxk/cybersecurity-skills-zh --skill analyzing-malware-persistence-with-autoruns

Installs into the current project.

Summary

使用 Sysinternals Autoruns 系统化识别和分析 Windows 系统上注册表键、计划任务、服务、驱动程序和启动位置中的恶意软件持久化机制。

Files · 1

View on GitHub

SKILL.md

1	# 使用 Autoruns 分析恶意软件持久化
2
3	## 概述
4
5	Sysinternals Autoruns 从 Windows 上的数百个自动启动扩展点（ASEP）提取数据，扫描 18 个以上类别，包括 Run/RunOnce 键、服务、计划任务、驱动程序、Winlogon 条目、LSA 提供程序、打印监视器、WMI 订阅和 AppInit DLL。数字签名验证过滤 Microsoft 签名条目。比较功能通过基线差异识别新增的持久化机制。VirusTotal 集成检查哈希信誉。通过 -z 标志进行离线分析，支持取证磁盘镜像检查。
6
7	## 前置条件
8
9	- Sysinternals Autoruns（GUI）和 Autorunsc（CLI）
10	- 目标系统上的管理员权限
11	- Python 3.9+，用于自动化分析
12	- VirusTotal API 密钥，用于信誉检查
13	- 干净的基线导出，用于比对
14
15	## 操作步骤
16
17	### 步骤 1：自动化持久化扫描
18
19	```python
20	#!/usr/bin/env python3
21	"""自动化基于 Autoruns 的持久化分析。"""
22	import subprocess
23	import csv
24	import json
25	import sys
26
27
28	def scan_and_analyze(autorunsc_path="autorunsc64.exe", csv_path="scan.csv"):
29	cmd = [autorunsc_path, "-a", "", "-c", "-h", "-s", "-nobanner", ""]
30	result = subprocess.run(cmd, capture_output=True, text=True, timeout=600)
31	with open(csv_path, 'w') as f:
32	f.write(result.stdout)
33	return parse_and_flag(csv_path)
34
35
36	def parse_and_flag(csv_path):
37	suspicious = []
38	with open(csv_path, 'r', errors='replace') as f:
39	for row in csv.DictReader(f):
40	reasons = []
41	signer = row.get("Signer", "")
42	if not signer or signer == "(Not verified)":
43	reasons.append("未签名的二进制文件")
44	if not row.get("Description") and not row.get("Company"):
45	reasons.append("缺少元数据")
46	path = row.get("Image Path", "").lower()
47	for sp in ["\temp\\", "\appdata\local\temp", "\users\public\\"]:
48	if sp in path:
49	reasons.append(f"可疑路径")
50	launch = row.get("Launch String", "").lower()
51	for kw in ["powershell", "cmd /c", "wscript", "mshta", "regsvr32"]:
52	if kw in launch:
53	reasons.append(f"LOLBin：{kw}")
54	if reasons:
55	row["reasons"] = reasons
56	suspicious.append(row)
57	return suspicious
58
59
60	if __name__ == "__main__":
61	if len(sys.argv) > 1:
62	results = parse_and_flag(sys.argv[1])
63	print(f"[!] {len(results)} 个可疑条目")
64	for r in results:
65	print(f" {r.get('Entry','')} - {r.get('Image Path','')}")
66	for reason in r.get('reasons', []):
67	print(f" - {reason}")
68	```
69
70	## 验证标准
71
72	- 扫描并记录所有 ASEP 类别
73	- 标记未签名条目以供调查
74	- 突出显示可疑路径和 LOLBin 启动字符串
75	- 基线比较识别新的持久化机制
76
77	## 参考资料
78
79	- [Sysinternals Autoruns](https://learn.microsoft.com/en-us/sysinternals/downloads/autoruns)
80	- [SANS - 重新审视离线 Autoruns](https://www.sans.org/blog/offline-autoruns-revisited-auditing-malware-persistence/)
81	- [使用 Autoruns 猎捕恶意软件](https://nasbench.medium.com/hunting-malware-with-windows-sysinternals-autoruns-19cbfe4103c2)
82	- [MITRE ATT&CK T1547 - 启动或登录自动启动](https://attack.mitre.org/techniques/T1547/)

People who liked this also viewed

6 picks

Type