4.3 Startup Items, Logs, and Basic System Review
What Auto-Starts at Boot
Malware wants to survive reboots, so persistence hunting starts where the OS auto-starts software. On Windows, the registry Run keys are the classic spots: HKLM\Software\Microsoft\Windows\CurrentVersion\Run and its HKCU and Wow6432Node siblings, plus RunOnce, the Startup folder under %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup, scheduled tasks, and services. On Linux, enumerate everything systemd will start with systemctl list-unit-files --state=enabled, list timers with systemctl list-timers, and collect every user's jobs with crontab -l plus /etc/crontab and /etc/cron.d/. Anything whose binary lives under a home directory or %APPDATA% deserves immediate scrutiny.
The Logs That Matter
Startup items announce themselves in logs, so query specific event IDs instead of scrolling. On Windows, Security log Event ID 4698 records a scheduled task being created, 4697 records a service install, and 7045 in the System log also flags new services; Event ID 1102 means the audit log was cleared, which is attacker housekeeping. Pull them with wevtutil qe System /q:"*[System[(EventID=7045)]]" or Get-WinEvent -FilterHashtable @{LogName='Security';ID=4698}. On Linux, journalctl -b -1 replays the previous boot, journalctl -u ssh --since "-7d" reviews authentication-driven intrusion attempts, and /var/log/auth.log shows sudo use.
A Repeatable Hunting Routine
Run the same five steps on every host. First, enumerate boot items and log them. Second, diff the list against a known-good baseline; new lines, not scary-looking names, are the signal -- malware often uses plausible names like svchost32 or kworker. Third, for each new entry, resolve the target path and check the file's signature or hash. Fourth, cross-check the creation time against the event logs above: a Run key added at 03:14 with no admin logon in Security events is anomalous. Fifth, record the finding; an anomaly you cannot prove later is an anomaly you cannot fix later.
Baselines and Deltas
Manual review does not scale, so script it. Export startup entries to a text file on every build and weekly, store the golden copy off-host, and alert on any delta. Autoruns covers the long tail of Windows hooks (Winsock providers, AppInit_DLLs, shell service objects) that manual checks miss, and on Linux compare /var/spool/cron/crontabs/ against configuration management output. Treat gaps in logging as findings in their own right: if the Security log is disabled or rotated to zero size, that is the first anomaly to flag.
Architecture Diagram
Key Takeaways
- Persistence hides in Run keys, RunOnce, services, scheduled tasks, systemd units, timers, and cron.
- Query event IDs directly: 4698 (task create), 4697/7045 (service install), 1102 (audit log cleared).
- Diff startup lists against an off-host baseline; new entries are the signal, scary names are theater.
- Any startup binary living in a user profile or home directory is presumptively malicious.
- Disabled or zero-retention logging is itself a finding -- you cannot review what was never recorded.