Step 15. ★ Project: What Happens After Boot? — A Full Survey of Auto-Start Locations

Level 0 — Understanding Computer Operation and Structure | Difficulty ★★★☆☆ | Estimated time 3–4 hours

Prerequisite: Step 14 complete. We will work in Windows PowerShell. A comprehensive project combining the investigation techniques from Steps 11–13. Today we query only — we do not delete or change anything we find.

• What you need: a Windows PC, PowerShell, Notepad. Nothing new gets installed.
• Caution: this section’s rule is just one — look only. Even if you find something that looks suspicious, do not delete it — the reason is covered in Wall 5. The deliverable is a single document, “a list of my computer’s auto-start locations,” the same kind of artifact a real security audit produces.

In the few minutes between pressing the power button and the screen coming up, dozens of programs inside your computer automatically arrive at work. Antivirus, cloud sync, sound drivers… all registered on the “run automatically at boot” roster. And uninvited guests can slip into that roster. For malware to survive a reboot, it must register somewhere — and those registration places are well known. Today is a full survey: we visit all of them as a four-piece set.

1. Learning Objectives

By the end of this unit, you will be able to:

• Explain what persistence is and why attackers use “doors that already exist”
• Enumerate the four auto-start locations (Run keys, Startup folder, scheduled tasks, automatic services) and query each
• Perform a first-pass screening using the three outward traits of suspicious entries
• Gather query results through a script and produce a single report document
• Know how to use that document as a “baseline” — the reference point for later comparison

2. Background Knowledge — Today’s Tools and Concepts

This section’s Tools at a Glance

2-1. Persistence — The Technology of Survival

The devices an attacker plants so that even after a reboot, their code runs again on a compromised computer are collectively called persistence techniques. It’s the formal name of what we met as “persistence” in Step 11.

Here’s one important insight: attackers don’t create new doors — they use doors that already exist. Windows already has several legitimate auto-start mechanisms (for updates, antivirus, and the like), and malware slips in through those legitimate doors. Because the best place to hide is “a place where you can pretend to be normal.”

So the defender’s logic is equally simple: pull the roster of every door, and ask each entry, “who are you?” That’s what we do today.

2-2. Four Doors — This section’s Investigation Map

Numbers 1 and 4 you already know. New today are 2 (Startup folder) and 3 (scheduled tasks), and at the end we merge all four into one document.

2-3. What Suspicious Looks Like — Screening Methods in Advance

Before investigating, let’s decide “what we regard as suspicious”:

• Random-looking names (xkqj2.exe, a7f.tmp) — legitimate programs have names
• Paths in temporary folders (Temp, AppData\Local\Temp) — legitimate installs go to Program Files
• A program you know, in the wrong location (C:\Windows\Temp\chrome.exe) — suspected name impersonation

Treat the initial inventory as an unverified baseline. Familiar names and installation paths help prioritize inspection but do not establish that every entry is benign.

3. Follow Along

Before you begin. This inventory covers selected startup locations, not every persistence technique. A query failure must appear in the report rather than being mistaken for an empty result.

3-1. The First Door — Run Keys (Review + Extension)

What you learned in Step 11, this time across both areas:

Get-ItemProperty "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run"
Get-ItemProperty "HKLM:\Software\Microsoft\Windows\CurrentVersion\Run"

Review points: the top is the current user’s, the bottom is the whole computer’s login auto-run. Malware prefers the lower one once it gains administrator privileges. Note the results — they form the first page of this section’s document.

3-2. The Second Door — The Startup Folder

This time it’s a physical place you reach through File Explorer:

1. Win + R (open the Run dialog)
2. Type shell:startup → OK
3. A folder opens — files/shortcuts in here run automatically at login

You can also check it from PowerShell:

Get-ChildItem "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup"

Name
----
ExampleNotes.lnk
ExampleSync.lnk

Illustrative output. Values, wording, account names, and available fields vary by environment.

Why attackers like it: because you never touch the registry — just copy a single file in and you’re done. An old trick precisely because it’s simple, but still in use today.

Predict this: what happens if you put a Notepad shortcut into this folder? (Answer: Notepad opens by itself at the next login. This is a safe experiment, so if you’d like — copy a Notepad shortcut in, log off, and log back in. Afterward, take it back out. A one-minute experiment for understanding “register it, and it auto-runs” with your whole body.)

3-3. The Third Door — Scheduled Tasks

Windows has a Task Scheduler — an alarm-clock system that runs programs on conditions like “every Tuesday,” “at boot,” or “when the machine goes idle”:

Get-ScheduledTask | Where-Object State -eq 'Ready' |
  Where-Object TaskPath -eq '\' | Select-Object TaskName

TaskName
--------
ExampleBackup
ExampleUpdater
ExampleReminder

Illustrative output. Values, wording, account names, and available fields vary by environment.

Ready is a scheduler state, not a security verdict. This first query selects only Ready tasks in the root folder. Tasks in other folders or states are outside that query.

These task names are fictional examples. Read the task action, executable path, arguments, principal, triggers, and available signature evidence. A familiar vendor or folder name alone does not clear a task.

Why do this: scheduled tasks are less widely known than Run keys, so attackers use them when they “want to hide a bit deeper.” It’s a location that appears often in recent breach reports.

3-4. The Fourth Door — Auto-Start Services

Step 13 review:

Get-Service | Where-Object StartType -eq Automatic | Measure-Object | Select-Object Count

Count
-----
  105

Illustrative output. Values, wording, account names, and available fields vary by environment.

The example counts 105 services configured for automatic start. Query their current State separately.

Get-Service | Where-Object StartType -eq Automatic | Select-Object Name, DisplayName -First 8

Name                         DisplayName
----                         -----------
AdskLicensingService         Autodesk Desktop Licensing Service
ALUpdateService              ESTsoft ALTools Update Service
AppXSvc                      AppX Deployment Service (AppXSVC)
AudioEndpointBuilder         Windows Audio Endpoint Builder
Audiosrv                     Windows Audio
Autodesk Access Service Host Autodesk Access Service Host
BFE                          Base Filtering Engine
BITS                         Background Intelligent Transfer Service

How to read it: mostly Windows components and helpers for installed programs. For something you can’t identify from the Name alone, like ALUpdateService, take a hint from the DisplayName (the display name), and if you still don’t know, search.

What suspicious looks like: a plausible DisplayName paired with an odd Name, or something whose identity doesn’t turn up in a search at all. Services reside out of the user’s sight, making them a good hiding place.

3-5. Merging Four Doors into One Document

Now let’s combine the harvest. Paste the script below into Notepad and save it as autoruns-report.ps1 — the encoding must be “UTF-8 with BOM” (a mandatory condition for scripts containing non-ASCII text; Step 9 review):

# Inspect selected startup locations without changing their configuration.
$auditDir = Join-Path $HOME ('infosec-startup-' + [guid]::NewGuid().ToString('N'))
New-Item -ItemType Directory -Path $auditDir -ErrorAction Stop | Out-Null
$out = Join-Path $auditDir 'autoruns-report.txt'
"Startup inventory - $(Get-Date -Format o)" |
    Out-File -LiteralPath $out -Encoding UTF8

function Add-InventorySection {
    param([string]$Title, [scriptblock]$Query)
    "`n[$Title]" | Out-File -LiteralPath $out -Append -Encoding UTF8
    try {
        $items = @(& $Query)
        if ($items.Count -eq 0) {
            'No items returned.' |
                Out-File -LiteralPath $out -Append -Encoding UTF8
        } else {
            $items | Format-List * |
                Out-File -LiteralPath $out -Append -Encoding UTF8 -Width 4096
        }
    } catch {
        "QUERY FAILED: $($_.Exception.Message)" |
            Out-File -LiteralPath $out -Append -Encoding UTF8
    }
}

Add-InventorySection '1 Registry Run key - current user' {
    Get-ItemProperty 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run' -ErrorAction Stop
}
Add-InventorySection '2 Startup folder - current user' {
    $startup = [Environment]::GetFolderPath('Startup')
    Get-ChildItem -LiteralPath $startup -Force -ErrorAction Stop |
        Select-Object Name, FullName, LastWriteTime
}
Add-InventorySection '3 Scheduled tasks - Ready' {
    Get-ScheduledTask -ErrorAction Stop |
        Where-Object State -eq Ready |
        Select-Object TaskPath, TaskName, State
}
Add-InventorySection '4 Automatic-start services' {
    Get-CimInstance Win32_Service -ErrorAction Stop |
        Where-Object StartMode -eq Auto |
        Select-Object Name, State, StartName, PathName
}
"Report written: $out"

Run it:

.\autoruns-report.ps1

Report written: autoruns-report.txt

Illustrative output. Values, wording, account names, and available fields vary by environment.

Reading the structure: all pieces you know — variables, Get-Date, Out-File -Append (Step 5), filtering (Step 8), and this section’s four query commands. The "`n" is a special character meaning “insert one blank line.”

Keep the first report unchanged and compare a later collection made with the same scope and permissions. A new line can reflect configuration, visibility, or state changes; it does not by itself prove a new installation.

4. Missions & Exercises

Mission — Add Screening Comments to the Report

Let’s upgrade the finished report:

1. Open autoruns-report.txt in Notepad
2. Skim through each section’s entries, and for things you recognize, mark the end of the line with ← recognized (“known, normal”)
3. For things you don’t recognize, mark ← needs investigation (“needs verification”), then search the name and investigate its identity (most will turn out to be Windows built-ins or programs you installed — that’s normal)
4. On the last line, write a one-line reflection: something like “Out of N locations totaling M entries, K were unknown; investigation cleared them all as normal”

Exercises

Question 1. What is persistence, and why do attackers use Windows’ built-in mechanisms instead of creating new ones?

Question 2. Enumerate the four auto-start locations and state “when” each one fires.

Question 3. Among 172 scheduled tasks, where is it efficient to start looking, and why?

Question 4. Comparing last month’s report with this section’s, one unknown line has newly appeared. State the next sequence of actions.

Name
----
ExampleNotes.lnk
ExampleSync.lnk

NVIDIA app SelfUpdate_{...}   ← needs investigation → check the publisher and executable; the name alone does not establish trust
OneDrive Startup Task-S-1-5-… ← recognized: OneDrive; the long identifier is an account SID
Run LG Live Wallpaper         ← recognized: monitor companion application

6. Common Pitfalls & Fixes

Wall 1. There are so many results, I don’t know where to start

Fix: prioritize unfamiliar actions and changed entries while preserving the complete collected inventory. Do not mark an item safe solely because it sits in a Microsoft-named folder.

Wall 2. Get-ScheduledTask throws an error

Symptom: a red error message.
Cause: some system tasks may be restricted from query under ordinary privileges.
Fix: run it from an administrator PowerShell (Step 12). Even then, some may remain invisible — that’s a matter of privilege, not your mistake.

Wall 3. The Startup folder path is hard to memorize

Symptom: typing the long path (AppData\Roaming\...) is painful.
Cause: you don’t need to memorize it.
Fix: Win + R → shell:startup is the official shortcut. Inside a script, $env:APPDATA fills in the path regardless of the username — the secret behind why the Section 3-5 script works unchanged on other computers.

Wall 4. Running the script throws a parsing error

If Windows PowerShell 5.1 misreads non-ASCII script text, inspect the encoding. Save the script as UTF-8 with BOM for compatibility, then reopen and verify it. PowerShell 7 has different default encoding behavior.

Wall 5. I think I found “something suspicious” and I’m anxious

Symptom: there’s an entry with a name you don’t know, and searching yields only vague information.
Cause: cases genuinely exist where a name alone doesn’t settle the judgment.
Fix: do not delete it. This section’s rule is query only. The sequence is ① check the file path (is it Temp-family, a strange location?) → ② use Step 13’s parent tracing to confirm who launches it → ③ if still suspicious, run a full antivirus scan. “Discover → investigate → judge,” not “discover → delete,” is the investigator’s order. Accidents of deleting legitimate system files break computers far more often than malware does.

7. Summary

This section’s Core Concepts

Investigation Command Summary

A Sense That Matters More Than Commands

Just remembering the three outward traits of suspicious things — ① random-looking names, ② Temp-family paths, ③ a known name in a strange location — covers most first-pass screening. And as you saw in this section’s NVIDIA case, appearance only selects “candidates for verification”; the verdict comes from the verification procedure.

Remember two more things. First, the security industry has a famous classification of attack techniques called MITRE ATT&CK. Open its “Persistence” chapter and you’ll find the locations we toured today organized with item numbers — today you hands-on practiced one chapter of that framework. Second, beyond the four places we investigated today, more auto-start locations exist, and Microsoft’s free tool Autoruns gathers them all onto one screen. In an arms race where attackers use each newly discovered hiding place first and defenders add it to their checklists, what you did today — location listing and a baseline document — is the straight-and-narrow way to close that gap.

Half of security work is investigation; the other half is record-keeping. Keep the document you made today safe. The moment you run the same script next month and compare, this document begins its real work as a baseline.

Once every box is checked, Step 15 is complete.