Skip to content

AutoRuns

Named by 4 kept items in this workspace.

Search every workspace for AutoRuns. It matches the name as written, so it can find other things that share it.

The items that name it 4

  • Field Notes: NSSM - the Non-Sucking Service Manager
    writeup2026-07-27

    Tool used to analyze startup/service entries during Compromise Assessment or Incident Response to spot suspicious entries like nssm.exe

  • Cross-Platform Unity in EDR
    article2026-01-13

    Huntress's first Managed EDR capability; point-in-time collection mechanism (survey) on a timer to gather information about scheduled tasks, services, etc., on Windows

  • Dissection of a PHP Backdoor leveraging php-win.exe
    writeup2025-11-16

    Used by the incident responder (Asger Deleuran Strunk) to review persistence data across servers/workstations and identify the suspicious ClockLauncher scheduled task

  • N-IOCs to Rule Them All
    writeup2023-12-31

    SysInternals tool used to hunt for Startup folder persistence mechanisms

All technologies in this workspace.