Reporting

Is there a way to monitor all program that are in Auto Run on Startup?

Kitteh
Path Finder

I am trying to find all programs that are set to auto run upon startup but however I've tried the registry key under Local Machine > Software > Microsoft > Windows > Current Version > Run, there are far less than what I thought it would. But however Task Manager shows much more auto run programs as shown in the attached image, how do I have splunk to monitor this?alt text

0 Karma
1 Solution

spayneort
Contributor

You can use Sysinternals Autoruns to see what is set to start automatically.

https://docs.microsoft.com/en-us/sysinternals/downloads/autoruns

Here is a script to convert the output of that tool into Splunk or Sysmon format. It recommends disabling all of the "Hide" options in Autoruns for best results.

https://github.com/dstaulcu/AutorunsToSysmon/

The "Splunking the Endpoint" session from .conf 2015 went over Autoruns registry monitoring and has a link to some configuration files on slide #8.

http://conf.splunk.com/session/2015/conf2015_Jbrodsky_Splunk_SecurityComplinace_SplunkingTheEndpoint...

View solution in original post

0 Karma

spayneort
Contributor

You can use Sysinternals Autoruns to see what is set to start automatically.

https://docs.microsoft.com/en-us/sysinternals/downloads/autoruns

Here is a script to convert the output of that tool into Splunk or Sysmon format. It recommends disabling all of the "Hide" options in Autoruns for best results.

https://github.com/dstaulcu/AutorunsToSysmon/

The "Splunking the Endpoint" session from .conf 2015 went over Autoruns registry monitoring and has a link to some configuration files on slide #8.

http://conf.splunk.com/session/2015/conf2015_Jbrodsky_Splunk_SecurityComplinace_SplunkingTheEndpoint...

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Onboarding New Hires & ...

This is the fifth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Now Playing: Splunk Education Summer Learning Premieres

It’s premiere season, and Splunk Education is rolling out new releases you won’t want to miss. Whether you’re ...

The Visibility Gap: Hybrid Networks and IT Services

The most forward thinking enterprises among us see their network as much more than infrastructure – it's their ...