Run keys and Startup folders

What it is

Run keys and Startup folders are the oldest and most common autostart locations in Windows. Every command line stored under a Run key, and every file dropped in a Startup folder, is launched when a user logs on. No administrative rights are needed for the per-user locations, which makes them a favourite first persistence mechanism for commodity malware and a quick win when triaging a host.

On Windows 8 and later, the StartupApproved keys record whether each entry is enabled or disabled, as set in Task Manager's Startup tab (and in Settings on Windows 10/11).

Location

The folder locations themselves come from Shell Folders / User Shell Folders under Software\Microsoft\Windows\CurrentVersion\Explorer (values Startup and Common Startup). Redirecting them is a persistence trick in its own right.

What it proves

• A program was set to start at logon, with its full command line (registry) or as a file or shortcut in a Startup folder.
• Scope: an NTUSER.DAT entry belongs to that user; a SOFTWARE entry applies to every user.
• Enabled or disabled: StartupApproved shows whether Windows will actually launch the entry.
• It does not prove the program ran. Confirm with Prefetch, BAM or process events.

Key fields

Timestamps

Retention and clearing

• Run entries stay until removed. Removal leaves no event by default; look for older values in hive transaction logs, in volume shadow copies and in unallocated hive space.
• RunOnce values are deleted by Windows just before (or, with !, just after) they run, so a one-shot payload may leave only the key LastWrite and execution artifacts.
• Deleting a value from Run does not remove its StartupApproved entry; an orphan StartupApproved value can reveal a removed Run entry.
• A decoy trick: an entry added to Run but marked disabled in StartupApproved looks like persistence yet never runs. Always check both.

Collection

• KAPE target: RegistryHivesUser (NTUSER.DAT), RegistryHivesSystem (SOFTWARE) and StartupFolders.
• Velociraptor (Windows.Triage.Targets): RegistryHivesUser, RegistryHivesSystem, StartupFolders. Live: Windows.Sys.StartupItems combines Run keys, StartupApproved and Startup folders.
• Built-in: the loaded NTUSER.DAT is locked; use reg save for the logged-on user or collect it from a shadow copy.

reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Run
reg query HKLM\Software\Microsoft\Windows\CurrentVersion\Run
reg query HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run
reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved /s
dir /a /t:c "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup" "%ProgramData%\Microsoft\Windows\Start Menu\Programs\StartUp"

Parsing tools

• Registry Explorer / RECmd (Eric Zimmerman): browse keys and export them with the community batch files.
• RegRipper: run plugin (SOFTWARE and NTUSER.DAT, including StartupApproved paths) and runonceex.
• Autoruns (Sysinternals, free): Logon tab lists Run keys and Startup folders, live or against an offline Windows directory.
• Velociraptor: Windows.Sys.StartupItems.
• LECmd (Eric Zimmerman): parses .lnk files found in Startup folders.
• Plaso: windows_run registry plugin.

Investigation tips

• Flag command lines pointing to \AppData\, \Temp\, \Users\Public\, or using powershell, mshta, rundll32, regsvr32, wscript or encoded arguments.
• Parse every user's NTUSER.DAT, including service and old accounts; persistence is often placed in a profile that is rarely used.
• Check StartupApproved for each Run value: a disabled entry did not run at the latest logons, and its FILETIME tells you when it was disabled.
• For Startup folder shortcuts, resolve the target and arguments of the .lnk and check the target's existence in the $MFT.
• Correlate the Run key LastWrite with Prefetch and the user's logon times to confirm the payload started.
• Continue with less common autostarts: Winlogon and IFEO, services and scheduled tasks.