Add startup and persistence analysis tools
Add Get-AutoRun.ps1, Get-ScheduledTasks.ps1, and Get-Services.ps1 for analyzing auto-start programs and persistence mechanisms. Get-AutoRun: Run/RunOnce keys, Startup folders, startup tasks Get-ScheduledTasks: Detailed task analysis with filters Get-Services: Service enumeration using WMI/CIM Uses Get-CimInstance for reliable service enumeration, avoiding Get-Service permission issues. Multiple filters and output modes. Update TODO.md.
This commit is contained in:
156
windows/Get-AutoRun.ps1
Normal file
156
windows/Get-AutoRun.ps1
Normal file
@@ -0,0 +1,156 @@
|
||||
# Get-AutoRun.ps1
|
||||
# Lists programs that auto-start via Run/RunOnce keys and Startup folders
|
||||
|
||||
param(
|
||||
[switch]$IncludeDisabled
|
||||
)
|
||||
|
||||
Write-Host "=== Auto-Start Programs ===" -ForegroundColor Cyan
|
||||
Write-Host "Programs configured to run at startup`n"
|
||||
|
||||
$foundAny = $false
|
||||
|
||||
# Registry Run keys to check
|
||||
$runKeys = @(
|
||||
@{Path="HKLM:\Software\Microsoft\Windows\CurrentVersion\Run"; Scope="System (All Users)"},
|
||||
@{Path="HKLM:\Software\Microsoft\Windows\CurrentVersion\RunOnce"; Scope="System (All Users, Once)"},
|
||||
@{Path="HKCU:\Software\Microsoft\Windows\CurrentVersion\Run"; Scope="Current User"},
|
||||
@{Path="HKCU:\Software\Microsoft\Windows\CurrentVersion\RunOnce"; Scope="Current User (Once)"},
|
||||
@{Path="HKLM:\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run"; Scope="System (32-bit on 64-bit)"},
|
||||
@{Path="HKLM:\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce"; Scope="System (32-bit, Once)"}
|
||||
)
|
||||
|
||||
# Check Run/RunOnce registry keys
|
||||
Write-Host "--- Registry Run Keys ---" -ForegroundColor Yellow
|
||||
|
||||
foreach ($key in $runKeys) {
|
||||
if (Test-Path $key.Path) {
|
||||
$entries = Get-ItemProperty -Path $key.Path -ErrorAction SilentlyContinue
|
||||
|
||||
if ($entries) {
|
||||
$props = $entries.PSObject.Properties | Where-Object { $_.Name -notmatch "^PS" }
|
||||
|
||||
if ($props) {
|
||||
$foundAny = $true
|
||||
Write-Host "`n$($key.Scope)" -ForegroundColor Green
|
||||
Write-Host " Path: $($key.Path)" -ForegroundColor Gray
|
||||
|
||||
foreach ($prop in $props) {
|
||||
Write-Host " - $($prop.Name):" -ForegroundColor Cyan
|
||||
Write-Host " $($prop.Value)" -ForegroundColor White
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
# Startup folders
|
||||
Write-Host "`n--- Startup Folders ---" -ForegroundColor Yellow
|
||||
|
||||
$startupFolders = @(
|
||||
@{Path="$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup"; Scope="Current User"},
|
||||
@{Path="$env:ProgramData\Microsoft\Windows\Start Menu\Programs\Startup"; Scope="All Users"}
|
||||
)
|
||||
|
||||
foreach ($folder in $startupFolders) {
|
||||
if (Test-Path $folder.Path) {
|
||||
$items = Get-ChildItem -Path $folder.Path -File -ErrorAction SilentlyContinue
|
||||
|
||||
if ($items) {
|
||||
$foundAny = $true
|
||||
Write-Host "`n$($folder.Scope)" -ForegroundColor Green
|
||||
Write-Host " Path: $($folder.Path)" -ForegroundColor Gray
|
||||
|
||||
foreach ($item in $items) {
|
||||
Write-Host " - $($item.Name)" -ForegroundColor Cyan
|
||||
Write-Host " $($item.FullName)" -ForegroundColor White
|
||||
|
||||
# If it's a shortcut, try to get target
|
||||
if ($item.Extension -eq ".lnk") {
|
||||
try {
|
||||
$shell = New-Object -ComObject WScript.Shell
|
||||
$shortcut = $shell.CreateShortcut($item.FullName)
|
||||
if ($shortcut.TargetPath) {
|
||||
Write-Host " Target: $($shortcut.TargetPath)" -ForegroundColor Gray
|
||||
if ($shortcut.Arguments) {
|
||||
Write-Host " Arguments: $($shortcut.Arguments)" -ForegroundColor Gray
|
||||
}
|
||||
}
|
||||
[System.Runtime.Interopservices.Marshal]::ReleaseComObject($shell) | Out-Null
|
||||
} catch {
|
||||
# Silently fail if can't read shortcut
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
# Task Scheduler startup tasks (basic check)
|
||||
Write-Host "`n--- Task Scheduler (Run at Startup) ---" -ForegroundColor Yellow
|
||||
try {
|
||||
$startupTasks = Get-ScheduledTask -ErrorAction SilentlyContinue |
|
||||
Where-Object {
|
||||
$_.Triggers.CimClass.CimClassName -contains "MSFT_TaskBootTrigger" -or
|
||||
$_.Triggers.CimClass.CimClassName -contains "MSFT_TaskLogonTrigger"
|
||||
} |
|
||||
Where-Object { $_.State -ne "Disabled" -or $IncludeDisabled }
|
||||
|
||||
if ($startupTasks) {
|
||||
$foundAny = $true
|
||||
|
||||
foreach ($task in $startupTasks) {
|
||||
$triggerType = if ($task.Triggers.CimClass.CimClassName -contains "MSFT_TaskBootTrigger") {
|
||||
"At system startup"
|
||||
} else {
|
||||
"At user logon"
|
||||
}
|
||||
|
||||
$state = if ($task.State -eq "Disabled") { " (DISABLED)" } else { "" }
|
||||
|
||||
Write-Host "`n - $($task.TaskName)$state" -ForegroundColor Cyan
|
||||
Write-Host " Path: $($task.TaskPath)" -ForegroundColor Gray
|
||||
Write-Host " Trigger: $triggerType" -ForegroundColor Gray
|
||||
Write-Host " State: $($task.State)" -ForegroundColor Gray
|
||||
|
||||
if ($task.Actions.Execute) {
|
||||
Write-Host " Command: $($task.Actions.Execute)" -ForegroundColor White
|
||||
if ($task.Actions.Arguments) {
|
||||
Write-Host " Arguments: $($task.Actions.Arguments)" -ForegroundColor Gray
|
||||
}
|
||||
}
|
||||
}
|
||||
} else {
|
||||
Write-Host " No startup tasks found" -ForegroundColor Gray
|
||||
}
|
||||
} catch {
|
||||
Write-Host " Error accessing scheduled tasks: $_" -ForegroundColor Red
|
||||
}
|
||||
|
||||
# Windows Services set to Automatic
|
||||
Write-Host "`n--- Services (Automatic Start) ---" -ForegroundColor Yellow
|
||||
try {
|
||||
# Try WMI method first (more reliable)
|
||||
$autoServices = Get-CimInstance Win32_Service -ErrorAction Stop |
|
||||
Where-Object { $_.StartMode -eq "Auto" }
|
||||
|
||||
if ($autoServices) {
|
||||
$foundAny = $true
|
||||
$running = $autoServices | Where-Object { $_.State -eq "Running" }
|
||||
$stopped = $autoServices | Where-Object { $_.State -ne "Running" }
|
||||
|
||||
Write-Host "`nRunning: $($running.Count) | Stopped: $($stopped.Count) | Total: $($autoServices.Count)" -ForegroundColor Green
|
||||
Write-Host "(Use Get-Services.ps1 for detailed service information)" -ForegroundColor Gray
|
||||
} else {
|
||||
Write-Host " No automatic services found" -ForegroundColor Gray
|
||||
}
|
||||
} catch {
|
||||
Write-Host " Unable to enumerate services" -ForegroundColor Yellow
|
||||
}
|
||||
|
||||
if (-not $foundAny) {
|
||||
Write-Host "`nNo auto-start programs found" -ForegroundColor Gray
|
||||
}
|
||||
|
||||
Write-Host "`nNote: Use -IncludeDisabled to show disabled scheduled tasks" -ForegroundColor Cyan
|
||||
Write-Host "Forensic value: Shows persistence mechanisms and startup performance impacts" -ForegroundColor Cyan
|
||||
Reference in New Issue
Block a user