analyzing-malware-persistence-with-autoruns

# 使用 Autoruns 分析恶意软件持久化

## 概述

Sysinternals Autoruns 从 Windows 上的数百个自动启动扩展点（ASEP）提取数据，扫描 18 个以上类别，包括 Run/RunOnce 键、服务、计划任务、驱动程序、Winlogon 条目、LSA 提供程序、打印监视器、WMI 订阅和 AppInit DLL。数字签名验证过滤 Microsoft 签名条目。比较功能通过基线差异识别新增的持久化机制。VirusTotal 集成检查哈希信誉。通过 -z 标志进行离线分析，支持取证磁盘镜像检查。

## 前置条件

- Sysinternals Autoruns（GUI）和 Autorunsc（CLI）
- 目标系统上的管理员权限
- Python 3.9+，用于自动化分析
- VirusTotal API 密钥，用于信誉检查
- 干净的基线导出，用于比对

## 操作步骤

### 步骤 1：自动化持久化扫描

```python
#!/usr/bin/env python3
"""自动化基于 Autoruns 的持久化分析。"""
import subprocess
import csv
import json
import sys


def scan_and_analyze(autorunsc_path="autorunsc64.exe", csv_path="scan.csv"):
    cmd = [autorunsc_path, "-a", "*", "-c", "-h", "-s", "-nobanner", "*"]
    result = subprocess.run(cmd, capture_output=True, text=True, timeout=600)
    with open(csv_path, 'w') as f:
        f.write(result.stdout)
    return parse_and_flag(csv_path)


def parse_and_flag(csv_path):
    suspicious = []
    with open(csv_path, 'r', errors='replace') as f:
        for row in csv.DictReader(f):
            reasons = []
            signer = row.get("Signer", "")
            if not signer or signer == "(Not verified)":
                reasons.append("未签名的二进制文件")
            if not row.get("Description") and not row.get("Company"):
                reasons.append("缺少元数据")
            path = row.get("Image Path", "").lower()
            for sp in ["\temp\\", "\appdata\local\temp", "\users\public\\"]:
                if sp in path:
                    reasons.append(f"可疑路径")
            launch = row.get("Launch String", "").lower()
            for kw in ["powershell", "cmd /c", "wscript", "mshta", "regsvr32"]:
                if kw in launch:
                    reasons.append(f"LOLBin：{kw}")
            if reasons:
                row["reasons"] = reasons
                suspicious.append(row)
    return suspicious


if __name__ == "__main__":
    if len(sys.argv) > 1:
        results = parse_and_flag(sys.argv[1])
        print(f"[!] {len(results)} 个可疑条目")
        for r in results:
            print(f"  {r.get('Entry','')} - {r.get('Image Path','')}")
            for reason in r.get('reasons', []):
                print(f"    - {reason}")
```

## 验证标准

- 扫描并记录所有 ASEP 类别
- 标记未签名条目以供调查
- 突出显示可疑路径和 LOLBin 启动字符串
- 基线比较识别新的持久化机制

## 参考资料

- [Sysinternals Autoruns](https://learn.microsoft.com/en-us/sysinternals/downloads/autoruns)
- [SANS - 重新审视离线 Autoruns](https://www.sans.org/blog/offline-autoruns-revisited-auditing-malware-persistence/)
- [使用 Autoruns 猎捕恶意软件](https://nasbench.medium.com/hunting-malware-with-windows-sysinternals-autoruns-19cbfe4103c2)
- [MITRE ATT&CK T1547 - 启动或登录自动启动](https://attack.mitre.org/techniques/T1547/)