GCIH · Question #737
What tool would an incident handler use to search for all autostart extensibility points (ASEPs) on a Windows host?
The correct answer is D. autoruns. Sysinternals Autoruns is the standard incident-response tool for enumerating all autostart extensibility points (ASEPs) on a Windows host. It covers far more persistence locations than any built-in Windows utility.
Question
What tool would an incident handler use to search for all autostart extensibility points (ASEPs) on a Windows host?
Options
- AWindows Firewall
- BWindows Event Viewer
- Cregedit
- Dautoruns
How the community answered
(27 responses)- A4% (1)
- B11% (3)
- D85% (23)
Why each option
Sysinternals Autoruns is the standard incident-response tool for enumerating all autostart extensibility points (ASEPs) on a Windows host. It covers far more persistence locations than any built-in Windows utility.
Windows Firewall manages inbound and outbound network traffic rules and has no capability to display or enumerate autostart programs.
Windows Event Viewer shows system, security, and application log entries but does not enumerate or display ASEP locations configured on the host.
Regedit allows manual navigation of registry keys but requires knowing which keys to examine and cannot automatically enumerate all the dozens of ASEP locations that Autoruns covers.
Autoruns, part of the Microsoft Sysinternals Suite, comprehensively enumerates every location where software can configure itself to launch automatically - including registry run keys, scheduled tasks, services, browser extensions, boot execute entries, and many more. This makes it the definitive tool for incident handlers hunting persistence mechanisms on a Windows system.
Concept tested: Enumerating Windows autostart extensibility points with Autoruns
Source: https://learn.microsoft.com/en-us/sysinternals/downloads/autoruns
Topics
Community Discussion
No community discussion yet for this question.