Local persistence

Windows DFIR notes are no longer maintained on InfoSec-Notes. Updated versions can be found on: artefacts.help.

Sysinternals' Autoruns

The Autoruns utility of the Sysinternals suite has the most comprehensive knowledge of auto-starting locations on Windows hosts.

The following ASEP are notably listed:

Startup folders
ASEP registries
Services
Scheduled tasks
Drivers
WMI providers
Internet explorer extensions

Autoruns verifies the digital signatures of the files and white list the files signed by known editors. The files appearing in yellow are usually missing and the files appearing in red are usually not digitally signed or not by a known editor.

Note that Autoruns DOES NOT check the loaded DLL by the programs that are run from ASEP.

CLI AutorunsC

The AutorunsC utility can be used to run Autoruns in CLI mode either on live host or on read-write partition mounted from a disk image.

The Arsenal-Image-Mounter open source utility can be used to mount disk images to a partition for offline ASEP analysis. However, the verification of files signature from trusted providers does not work as well as on live hosts.

# All ASEP (-a) exported to CSV (-c) format with VirusTotal digital signature verification (-v), exclusion of digitally signed Microsoft entries (-m) and files hashes.

# Live hosts
Autorunsc.exe -a * -c -v -m -s -h

# From a mounted partition
Autorunsc.exe -a * -c -v -m -s -h -z <PARTITION_DRIVE_LETTER>

Local accounts

This section only covers local accounts / groups and does not include persistence through Active Directory domain accounts / groups.

While not directly allowing remote code execution, local accounts may be used as a mean of persistence, notably on machine exposing remote access services, such as SMB or Terminal Services, on the Internet.

Live forensics

The Windows built-in net utility can be used to enumerate local users and local groups:

# Enumerates the local users and the specified user attributes (including the accounts' password last set timestamp).
net user
net user "<Administrator | USERNAME>"

# Enumerates the local groups and the specified group members.
net localgroup
net localgroup "<Administrators | GROUP>"

Registry

The local users are stored in the Securiry Account Manager (SAM) registry database, located at: %WinDir%\System32\config\SAM, under the following registry keys:

SAM\Domains\Account\Users

The user's attributes (username, RID, Last Password Change, group memberships, etc.) are stored in the SAM.

Windows EVTX logs

The following events could be indicators of persistence on the machine through local accounts and / or groups:

Hive

Event ID

Conditions

Description

Information yield

Security.evtx

4720

Default configuration. Logged whenever a local account is created.

Event 4720: A user account was created. Legacy: Event 624: User Account Created.

Creator's domain, username and Logon ID. Created user's domaine and username.

Security.evtx

4722

Default configuration. Always logged after a Security event 4720 - user account creation.

Event 4722: A user account enabled Legacy: Event 626: User Account Enabled.

Security.evtx

4723

By default, only logged whenever an user successfully change their own password. Failures logged if Audit User Account Management is set to (Success), Failure.

Event 4723: An attempt was made to change an account's password. Logged as a success (Audit Success) if the user did change their password (which requires to enter the current correct password). Otherwise reported as a failure (Audit Failure) if failures are logged and an error occurred (wrong current password given, new password fails to meet the password policy). Legacy: Event 627: Change Password Attempt.

Domain, username and Logon ID of the user that performed the password change. Target user's domain and username.

Security.evtx

4724

By default, only logged whenever an user successfully reset the specified user's password. Failures logged if Audit User Account Management is set to (Success), Failure. A Failure event is NOT generated if the user gets an Access Denied error while attempting the password reset.

Event 4724: An attempt was made to reset an accounts password. Logged as a success (Audit Success) if the user did reset the specified user password (which requires elevated rights for local accounts). Otherwise reported as a failure (Audit Failure) if failures are logged and the new password failed to meet the password policy. Legacy: Event 628: User Account password set.

Domain, username and Logon ID of the user that performed the password change. Target user's domain and username.

Security.evtx

4738

Default configuration. Logged when an user object attributes are modified (for password change, a successful update / reset).

Event 4738: A user account was changed. For password change, update to the Password Last Set field. Legacy: Event 642: User Account Changed.

Domain, username and Logon ID of the user that performed the password change. Target user's domain and username.

Security.evtx

4732

Default configuration. Logged whenever an account is added to a local security group.

Event 4732: A member was added to a security-enabled local group. Legacy: Event 636: Security Enabled Local Group Member Added.

Domain, username and Logon ID of the user that performed the action. Target group and added user's domain and username.

Windows startup folders

The Windows startup folders contains shortcut links (.lnk) that will be executed upon any user log in (All Users start up folder) or when the associated user logs in (Current Users start up folders).

Filesystem

# All Users startup folder.
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup

# Current Users startup folders.
C:\Users\<USERNAME>\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup

The Everything tab of the Sysinternals' Autoruns utility can be used to enumerate the programs starting through Windows startup folders on a live system or on a partition mounted from a disk image.

In addition to the Sysinternals' Autoruns utility, the following PowerShell script may be used as well:

. .\Get-StartupFoldersLnkTargets.ps1

Get-StartupFoldersLnkTargets
Get-StartupFoldersLnkTargets -Drive "F:"

<#
    .SYNOPSIS
        Get all the starting programs through start up folders

    .DESCRIPTION
      Enumerate all the startup folders lnk using Get-ChildItem and retrieve the lnk targets

    .EXAMPLE
        Get-StartupFoldersLnk -Drive D:
#>

function Get-StartupFoldersLnkTargets {

    param (
        [Parameter(Mandatory=$false)]
        [string]$Drive = "C:"
    )

    $Shell = New-Object -ComObject WScript.Shell

    Get-ChildItem -Force "$Drive\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\*.lnk" -ErrorAction SilentlyContinue | ForEach-Object {
        [pscustomobject]@{
            LnkFullPath = $_.FullName
            LnkTarget = $Shell.CreateShortcut($_).TargetPath
        }
    }

    $Usernames = Get-ChildItem -Force "$Drive\Users" -ErrorAction SilentlyContinue | Select-Object -ExpandProperty  Name

    foreach ($Username in $Usernames) {
	    Get-ChildItem -ErrorAction SilentlyContinue -Force "$Drive\Users\$Username\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\*.lnk" | ForEach-Object {
            [pscustomobject]@{
                LnkFullPath = $_.FullName
                LnkTarget = $Shell.CreateShortcut($_).TargetPath
            }
        }
    }
}

ASEP registry keys

A number of registry keys, known as Auto-Start Extensibility Points (ASEP) registry keys, are run whenever the system is booted or a specific user logs in. The ASEP keys under HKEY_LOCAL_MACHINE (HKLM) are run every time the system is started, while the ASEP keys under HKEY_CURRENT_USER (HKCU) are only executed when the user associated with the keys logs on to the system.

Indeed, each user with a configured profile has an associated HKCU\<USERNAME> sub key, which contains the registries keys of the user. The HKCU keys are stored in the %SystemDrive%\Users\<USERNAME\NTUSER.DAT file.

Each entry is composed of a key and an associated value that may contain a program, and the program arguments if any, to be run.

The RegistryExplorer.exe / RECmd.exe utilities leverage transaction log files, for example ntuser.dat.LOG1, to identify and recover deleted keys / values. The transaction log files must be present in the same directory as the analyzed hive.

The most commons ASEP keys can be automatically checked using the SysInternals' GUI Autoruns and CLI AutorunsC utilities. The RECmd CLI utility can also be used to access a predefined list of ASEP registries keys. The RegistryASEPs.reb enumerate a comprehensive list of nearly ASEP 500 registry keys and 400 values. The results of RECmd can be analyzed using Timeline Explorer.

Alternatively, RegistryExplorer.exe implements a number of bookmarks which are well-known key / value pairs. The bookmarks include a number of ASEP registry entries.

RECmd.exe -d <NTFS_VOLUME | FOLDER_CONTAINING_REGISTRY_HIVES> --bn .\BatchExamples\RegistryASEPs.reb --csv <OUTPUT_FOLDER>

The following run keys are commonly used for persistence:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Shell
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify
HKLM\SOFTWARE\Policies\Microsoft\Windows\System\Scripts\Startup
HKLM\SOFTWARE\Policies\Microsoft\Windows\System\Scripts\Logon
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Taskman
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\Appinit_Dlls
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved
HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar
HKLM\System\CurrentControlSet\Services

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Shell
HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify
HKCU\SOFTWARE\Policies\Microsoft\Windows\System\Scripts\Startup
HKCU\SOFTWARE\Policies\Microsoft\Windows\System\Scripts\Logon
HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell
HKCU\SOFTWARE\Microsoft\Active Setup\Installed Components
HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\Load
HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\Run
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run

Windows EVTX logs

The following events could be indicators of execution on the machine of persistence through ASEP registry keys:

Hive

Event ID

Conditions

Description

Information yield

Microsoft-Windows-Shell-Core%4Operational.evtx

9707 9708

Default configuration. Introduced in Windows 10 and Windows Server 2016. Logged whenever a program is executed through the Run / RunOnce registry keys.

Event 9707: Started execution of command '<COMMAND>'. Event 9708: Finished execution of command '<COMMAND>'.

Username and domain of the user responsible for the execution. Program / command executed.

Security.evtx

4657

Logged whenever an user modify a registry key for which the audit policy is set to audit usage of the Set Value rights (by the user.) Requires: - Audit: Force audit policy subcategory settings to be enabled. - Audit object access set to Success(, Failure). - The SACL on the ASEP registry keys to define audit on the rights Create Subkey, Set Value, Create Link, Write DAC, and Delete for the user conducting the action (possibly through identity / group membership, such as, for example, Everyone). -> very likely not logged.

Event 4657: A registry value was modified.

Username, domain, and LogonID of the user conducting the modification. Registry key modified and the new value defined.

Windows scheduled tasks

Scheduled tasks are used to automatically perform a task on the system whenever the criteria associated to the scheduled task occurs. The scheduled tasks can either be run at a defined time, on repeat at set intervals, or when a specific event occurs, such as the system boot.

Note that a scheduled task can continue to run even if its associated elements in the registry and / or on disk (XML files) are deleted. The scheduled task will be fully hidden but will persist until the system is rebooted or the svchost.exe process associated with that task is terminated. The ETW events generated by the task execution will however still be generated.

Live forensics

The Scheduled Tasks tab of the Sysinternals' Autoruns utility can be used to enumerate the programs starting through Windows scheduled tasks. The following DOS and PowerShell utilities may be used as well.

# Verbose - includes task name, task to run, status, hostname & logon mode, last run time, running user, periodicity, etc.
schtasks /query /fo LIST /v

# List scheduled task - minimal information
Get-ScheduledTask

# Retrieve information - task name, task to run, next and last run time
Get-ScheduledTaskInfo -TaskName "<TASK_NAME>"

The following PowerShell cmdlet can be used to export the configured scheduled tasks to the specified csv file.

Usage:

. .\Export_ScheduledTasks.ps1

Export-ScheduledTasksToCsv -OutCsv <CSV_PATH>

function Export-ScheduledTasksToCsv {

    <#
    .SYNOPSIS
      Export the configured scheduled tasks to a csv using Get-ScheduledTask and Get-ScheduledTaskInfo

    .PARAMETER OutCsv
      File to export the CSV

    #>

    Param(
    [Parameter(Mandatory=$true)]
    [string] $OutCsv
    )

    Get-ScheduledTask |
        ForEach-Object { [pscustomobject]@{
            Server = $env:COMPUTERNAME
            Name = $_.TaskName
            Path = $_.TaskPath
            Description = $_.Description
            Author = $_.Author
            RunAsUser = $_.Principal.userid
            LastRunTime = $(($_ | Get-ScheduledTaskInfo).LastRunTime)
            LastResult = $(($_ | Get-ScheduledTaskInfo).LastTaskResult)
            NextRun = $(($_ | Get-ScheduledTaskInfo).NextRunTime)
            Status = $_.State
            Command = $_.Actions.execute
            Arguments = $_.Actions.Arguments }
     } | Export-Csv -Path $OutCsv -NoTypeInformation
}

Filesystem

The scheduled tasks are stored in human readable XML file on the following location, depending on the Windows Operating System in use:

<= Windows XP / Windows Server 2003 (Task Scheduler 1.0): C:\Windows\Tasks
Starting from Windows 7 / Windows Server 2008 (Task Scheduler 2.0): C:\Windows\System32\Tasks

Registry

The scheduled tasks are stored under the following registry keys (as listed in the ASEP registry keys section), located at %WinDir%\System32\config\SOFTWARE:

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\Taskcache\Tasks
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\Taskcache\Tree

Windows EVTX logs

The following events could be indicators of persistence on the machine through scheduled tasks:

Hive

Event ID

Conditions

Description

Information yield