p0w3rsh3ll/AutoRuns

# AutoRuns PowerShell 模块 **AutoRuns 模块旨在帮助进行实时事件响应，并枚举可能被合法程序以及恶意软件用于实现持久化的 autoruns 项。** ## 目录 * [用法](#Usage) * [安装模块](#Install) * [函数](#Functions) * [帮助](#Help) * [问题](#issues) * [待办事项](#Todo) * [致谢](#Credits) * [原始 Autoruns 文档](#AutorunsDoc) * [原始 Autoruns.exe 发布历史](#AutorunsHistory) ## 用法 ### 安装模块 该模块位于 [PowerShellGallery](https://www.powershellgallery.com/packages/AutoRuns/14.0.2) ``` # 使用 PowerShellGet cmdlets 检查 powershellgallery.com 上的 module Find-Module -Name Autoruns -Repository PSGallery ``` ``` Version Name Repository Description ------- ---- ---------- ----------- 14.3.1 AutoRuns PSGallery AutoRuns is a module ... ``` ``` # 将 module 本地保存到 Downloads 文件夹中 Save-Module -Name AutoRuns -Repository PSGallery -Path ~/Downloads ``` 请先停止操作并仔细检查模块的内容，即查看代码以确保其可信 :-) 你还可以验证下载文件的 SHA256 哈希值是否与目录文件中存储的哈希值匹配 ``` $HT = @{ CatalogFilePath = "~/Downloads/AutoRuns/14.3.1/AutoRuns.cat" Path = "~/Downloads/AutoRuns/14.3.1" Detailed = $true FilesToSkip = 'PSGetModuleInfo.xml' } Test-FileCatalog @HT ``` ``` # 导入 module Import-Module ~/Downloads/AutoRuns/14.3.1/AutoRuns.psd1 -Force -Verbose ``` ### 检查可用命令 ``` Get-Command -Module AutoRuns ``` ``` CommandType Name Version Source ----------- ---- ------- ------ Function Compare-AutoRunsBaseLine 14.3.1 AutoRuns Function Get-PSAutorun 14.3.1 AutoRuns Function New-AutoRunsBaseLine 14.3.1 AutoRuns ``` ### 查找语法 #### Get-PSAutorun ``` # 查看 Get-PSAutorun 的语法 Get-Command Get-PSAutorun -Syntax Get-PSAutorun [-All] [-BootExecute] [-AppinitDLLs] [-ExplorerAddons] [-ImageHijacks] [-InternetExplorerAddons] [-KnownDLLs] [-Logon] [-Winsock] [-Codecs] [-OfficeAddins] [-PrintMonitorDLLs] [-LSAsecurityProviders] [-ServicesAndDrivers] [-ScheduledTasks] [-Winlogon] [-WMI] [-PSProfiles] [-ShowFileHash] [-VerifyDigitalSignature] [-User ] [] Get-PSAutorun [-All] [-BootExecute] [-AppinitDLLs] [-ExplorerAddons] [-ImageHijacks] [-InternetExplorerAddons] [-KnownDLLs] [-Logon] [-Winsock] [-Codecs] [-OfficeAddins] [-PrintMonitorDLLs] [-LSAsecurityProviders] [-ServicesAndDrivers] [-ScheduledTasks] [-Winlogon] [-WMI] [-PSProfiles] [-Raw] [-User ] [] ``` #### New-AutoRunsBaseLine ``` # 查看 New-AutoRunsBaseLine 的语法 Get-Command New-AutoRunsBaseLine -Syntax New-AutoRunsBaseLine [-InputObject] [[-FilePath] ] [-WhatIf] [-Confirm] [] ``` #### Compare-AutoRunsBaseLine ``` # 查看 Compare-AutoRunsBaseLine 的语法 Get-Command Compare-AutoRunsBaseLine -Syntax Compare-AutoRunsBaseLine [[-ReferenceBaseLineFile] ] [[-DifferenceBaseLineFile] ] [] ``` ### 查看帮助中提供的示例 #### Get-PSAutorun ``` # 从帮助中获取示例 Get-Help Get-PSAutorun -Examples NAME Get-PSAutorun SYNOPSIS Get Autorun entries. -------------------------- EXAMPLE 1 -------------------------- PS C:\>Get-PSAutorun -BootExecute -AppinitDLLs -------------------------- EXAMPLE 2 -------------------------- PS C:\>Get-PSAutorun -KnownDLLs -LSAsecurityProviders -ShowFileHash -------------------------- EXAMPLE 3 -------------------------- PS C:\>Get-PSAutorun -All -ShowFileHash -VerifyDigitalSignature -------------------------- EXAMPLE 4 -------------------------- PS C:\>Get-PSAutorun -All -User * -ShowFileHash -VerifyDigitalSignature ``` #### New-AutoRunsBaseLine ``` # 将 Get-PSAutorun 的过滤输出通过管道传递给 New-AutoRunsBaseLine function 将在 ~/Documents 中创建一个 .ps1 文件 Get-PSAutorun -VerifyDigitalSignature | Where { -not($_.isOSbinary)} | New-AutoRunsBaseLine -Verbose # 在 Windows PowerShell 上，你可以使用 Out-GridView cmdlet 运行并查看所创建文件的内容 ~\Documents\PSAutoRunsBaseLine-20201102214715.ps1 | Out-GridView -PassThru ``` #### Compare-AutoRunsBaseLine ``` # 你需要由 New-AutoRunsBaseLine function 在 ~/Documents 中生成的两个文件 Compare-AutoRunsBaseLine -Verbose ``` ## 问题 * Autoruns v13.7 中引入的 WMI\Default 命名空间中的注册项是什么？请参见 [c7eab48c77f578e0dcff61d2b46a479b28225a56](https://github.com/p0w3rsh3ll/AutoRuns/commit/c7eab48c77f578e0dcff61d2b46a479b28225a56) * 如果你运行的是 PowerShell 5.1 并且 Applocker 处于允许模式，你需要添加一个本地 applocker 规则以允许加载该模块。 该模块文件不再使用 DigiCert 证书进行签名。 如果你的企业管理员在已加入域的设备上关闭了本地组策略对象处理，你将需要在域组策略中添加受信任的发布者规则。 ``` gp 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\System' -Name DisableLGPOProcessing -EA 0 ``` ## 待办事项 #### 编程最佳实践 - [x] 使用 PSScriptAnalyzer 模块验证代码是否遵循最佳实践 - [x] 为此模块编写 Pester 测试 #### 操作系统和软件兼容性 - [x] 在 PowerShell Core 7.x（最新版）中测试该模块 - [x] 在各种版本的 Windows 11 上测试该模块 - [x] 23H2 - [ ] 25H2 - [ ] 26H2 - [ ] 使用 Office x86 和 x64 版本审查 Office 加载项代码 #### 常规改进 - [ ] 为内部的 Get-RegValue 函数编写更好的实现 - [ ] 审查并改进内部 Get-PSPrettyAutorun 函数使用的正则表达式（例如：外部路径） #### 新功能 - [x] 替换 HKCU 并添加一个选项以指定要调查的用户 hive - [ ] 在注册表项上添加时间戳 - [ ] 分析 Windows 的离线映像 - [x] 创建基准 - [x] 比较两个基准 #### 帮助 - [ ] 更多示例 - [ ] 使用外部帮助？ - [ ] 国际化？ - [ ] 将更新日志复制到 README.md 的模块末尾 - [x] 记录问题并编写 pester 测试，以便在修复后验证模块行为 ## 其他链接 - [https://live.sysinternals.com](https://live.sysinternals.com/) - [https://docs.microsoft.com/en-us/sysinternals](https://docs.microsoft.com/en-us/sysinternals/) - [https://docs.microsoft.com/en-us/archive/blogs/sysinternals](https://docs.microsoft.com/en-us/archive/blogs/sysinternals/) ## 来自 Mark Russinovich 的原始 [Autoruns.exe](https://docs.microsoft.com/en-us/sysinternals/downloads/autoruns) [Autoruns v14.3](https://techcommunity.microsoft.com/blog/sysinternals-blog/autoruns-zoomit-coreinfo-debugview-livekd-procdump-for-linux-process-monitor-and/4528947) [Autoruns v14.2](https://techcommunity.microsoft.com/blog/sysinternals-blog/autoruns-procdump-zoomit-debugview-notmyfault-procexp-procmon-and-linux-tools/4517553) [Autoruns v14.11](https://techcommunity.microsoft.com/t5/sysinternals-blog/procdump-3-2-for-linux-zoomit-v8-0-and-autoruns-v14-11/ba-p/4050610) [Autoruns v14.1](https://techcommunity.microsoft.com/t5/sysinternals-blog/sysmon-v15-0-autoruns-v14-1-and-process-monitor-v3-95/ba-p/3857916) [Autoruns v14.09](https://techcommunity.microsoft.com/t5/sysinternals-blog/autoruns-v14-09-procmon-v3-89-sysmon-v13-33-and-zoomit-v5-10/ba-p/3176054) [Autoruns v14.08](https://techcommunity.microsoft.com/t5/sysinternals-blog/zoomit-v5-0-rdcman-v2-90-autoruns-procmon-tcpview-vmmap-sysmon/ba-p/3075276) [Autoruns v14.07](https://techcommunity.microsoft.com/t5/sysinternals-blog/adexplorer-v1-51-autoruns-v14-07-cacheset-v1-02-process-monitor/ba-p/3040515) [Autoruns v14.06](https://techcommunity.microsoft.com/t5/sysinternals-blog/autoruns-v14-06-and-sysmon-v13-30/ba-p/2887598) [Autoruns v14.05](https://techcommunity.microsoft.com/t5/sysinternals-blog/autoruns-v14-05/ba-p/2844204) [Autoruns v14.04](https://techcommunity.microsoft.com/t5/sysinternals-blog/autoruns-v14-04-high-dpi-icons-for-winobj-tcpview-process/ba-p/2839719) [Autoruns v14.03](https://techcommunity.microsoft.com/t5/sysinternals-blog/autoruns-v14-03/ba-p/2800248) [Autoruns v14.02](https://techcommunity.microsoft.com/t5/sysinternals-blog/autoruns-v14-02-winobj-v3-12-tcpview-v4-15-and-process-monitor/ba-p/2775709) [Autoruns v14.01](https://techcommunity.microsoft.com/t5/sysinternals-blog/autoruns-v14-01/ba-p/2708458) [Autoruns v14.0](https://techcommunity.microsoft.com/t5/sysinternals-blog/autoruns-v14-0-rdcman-v2-83-procdump-v10-11-dark-theme-updates/ba-p/2661936) [Autoruns v13.100](https://techcommunity.microsoft.com/t5/sysinternals-blog/autoruns-v13-100/ba-p/2282998) [Autoruns v13.99](https://techcommunity.microsoft.com/t5/sysinternals-blog/procmon-v3-70-sysmon-v13-10-autoruns-v13-99-tcpview-v4-01-and/ba-p/2280263) [Autoruns v13.98](https://techcommunity.microsoft.com/t5/sysinternals-blog/sysmon-v11-10-sigcheck-v2-80-autoruns-v13-98/ba-p/1485287) [Autoruns v13.95](https://blogs.technet.microsoft.com/sysinternals/2019/06/12/sysmon-v10-0-autoruns-v13-95-vmmap-v3-26/) [Autoruns v13.94](https://blogs.technet.microsoft.com/sysinternals/2019/02/19/sysmon-v9-0-autoruns-v13-94/) [Autoruns v13.93](https://blogs.technet.microsoft.com/sysinternals/2018/12/09/autoruns-v13-93-handle-v4-21-process-explorer-v16-22-sdelete-v2-02-sigcheck-v2-71-sysmon-v8-02-and-vmmap-v3-25/) [Autoruns v13.90](https://blogs.technet.microsoft.com/sysinternals/2018/07/05/sysmon-v8-0-autoruns-v13-90/) [Autoruns v13.82](https://blogs.technet.microsoft.com/sysinternals/2018/02/17/process-monitor-v3-50-autoruns-v13-82-du-v1-61-sdelete-v2-01/) [Autoruns v13.81](https://blogs.technet.microsoft.com/sysinternals/2017/12/12/autoruns-v13-81-bginfo-v423-handle-v4-11/) [Autoruns v13.80](https://blogs.technet.microsoft.com/sysinternals/2017/09/12/sysinternals-update-sysmon-v6-1-process-monitor-v3-4-autoruns-v13-8-accesschk-v6-11/) [Autoruns v13.71](https://blogs.technet.microsoft.com/sysinternals/2017/05/16/sysinternals-update-procdump-v9-autoruns-v13-71-bginfo-v4-22-livekd-v5-62-process-monitor-v3-33-process-explorer-v16-21/) [Autoruns v13.7](https://blogs.technet.microsoft.com/sysinternals/2017/02/17/update-sysmon-v6-autoruns-v13-7-accesschk-v6-1-process-monitor-v3-32-process-explorer-v16-2-livekd-v5-61-and-bginfo-v4-21/) [Autoruns v13.51](https://blogs.technet.microsoft.com/sysinternals/2016/01/05/update-sigcheck-v2-4-sysmon-v3-2-process-explorer-v16-1-autoruns-v13-51-accesschk-v6-01/) [Autoruns v13.5](https://blogs.technet.microsoft.com/sysinternals/2015/10/26/update-autoruns-v13-5-sigcheck-v2-3-rammap-v1-4-bginfo-v4-21-sysmon-v3-11-adinsight-v1-2/) [Autoruns v13.4](https://blogs.technet.microsoft.com/sysinternals/2015/05/26/update-accesschk-v6-0-autoruns-v13-4-process-monitor-v3-2-vmmap-v3-2/) [Autoruns v13.3](https://blogs.technet.microsoft.com/sysinternals/2015/04/20/update-sysmon-v3-0-autornus-v13-3-regjump-v1-1-process-monitor-v3-11/) [Autoruns v13.2](https://blogs.technet.microsoft.com/sysinternals/2015/03/10/update-livekd-v5-4-autoruns-v13-2-sigcheck-v2-2-process-explorer-v16-05/) [Autoruns v13.01](https://blogs.technet.microsoft.com/sysinternals/2015/02/09/update-autoruns-v13-01/) [Autoruns v13.0](https://blogs.technet.microsoft.com/sysinternals/2015/01/29/update-autoruns-v13-0/) [Autoruns v12.03](https://blogs.technet.microsoft.com/sysinternals/2014/09/11/updates-handle-v4-0-procdump-v7-01-procexp-v16-04-regjump-v1-02-autoruns-v12-03/) [Autoruns v12.02](https://blogs.technet.microsoft.com/sysinternals/2014/08/19/updates-autoruns-v12-02-coreinfo-v3-31-sysmon-v1-01-whois-v1-12/) [Autoruns v12.01](https://blogs.technet.microsoft.com/sysinternals/2014/08/08/new-sysmon-v1-0-updates-autoruns-v12-01-coreinfo-v3-3-procexp-v16-03/) [Autoruns v12.0](https://blogs.technet.microsoft.com/sysinternals/2014/05/13/updates-autoruns-v12-0-procdump-v7-0/) [Autoruns v11.70](https://blogs.technet.microsoft.com/sysinternals/2013/08/01/autoruns-v11-70-bginfo-v4-20-disk2vhd-v1-64-process-explorer-v15-40/) [Autoruns v11.62](https://blogs.technet.microsoft.com/sysinternals/2013/07/01/update-autoruns-v11-62/)