🤔 How Do I Check For Malicious Autostarts?

Windows

Tasks

Event logs

Two trails are of use are Microsoft-Windows-TaskScheduler/Operational 🍇 (disabled by default on the newer systems) and Security 🛡️.

✍🏻 On older Win 👴🏼 it’s 602 event. Also, config files are in bin format with .job extension and can be parsed by a jobparser.py script.

Also, scheduled tasks create an XML (on newer) or bin (👴🏼) config files with helpful information like the account used, timestamps and activities scheduled. Simply go to Windows\System32\Tasks or Windows\SysWoW64\Tasks (for 32-bit) folders. Bot at.exe and schtasks.exe produce this artefact. If you know that’s a malicious task, note the account used to create it, and you have a lead because it’s likely compromised. Bingo!

References