6. 1) Generate
1) Tab-delimited CSV option
autorunsc -ct
2) Verify Signatures
autorunsc -s
3) Logfile is named with the hostname or IP
Address of the source system
“DD-HR” is the name of the log for the system DD-
HR
7. 2) Collect
for /f %%a in (host-list.txt) do (
psexec -accepteula %%a -c
autorunsc.exe -accepteula -a * -s -m -t -
h -ct * > Logs%%a.csv
)
8. 3) Normalize -Removal of autoruns’ header rows
-Addition of unique identifier to each message
-Addition of src hostname to each message
-Addition of runtime to each message
-Conversion to ASCII
-Replacement of TAB delimiter with a Pipe
15. Drivers
All non-disabled drivers at the time of log generation
ELSA Queries:
groupby:path -system32 -syswow64
groupby:company (Look for unsigned drivers)
16. Logon
Common Startup areas: Run & RunOnce keys, Start Menu
ELSA Queries:
groupby:path, +users - Stack
groupby:company - Stack
20. Services
All Autostart services on the system
ELSA Queries:
groupby:path - Show all results outside of the System32
Folder - Stack
groupby:company - Stack