Windows registry artifactRun (SYSTEM)
Program execution upon successful user logon
- Autoruns
- 2 keys
SOFTWARE
Registry keys
2 keys that RECmd reads for this artifact
SOFTWAREMicrosoft\Windows\CurrentVersion\RunProgram execution upon successful user logon
SOFTWAREWOW6432Node\Microsoft\Windows\CurrentVersion\RunProgram execution upon successful user logon
References
1 link
Source: RECmd/BatchExamples/DFIRBatch.reb(opens in new tab) v2.22 by Andrew Rathbun and contributors(opens in new tab), MIT License(opens in new tab)