Run and RunOnce keys

Location & availability

HKCU/HKLM\Software\Microsoft\Windows\CurrentVersion\Run and RunOnce; relevant architecture views

Different user profiles and registry views can contain different values. RunOnce entries can be transient.

Fields to examine

• Value name and complete command string.
• Hive, user context and registry view.
• Key LastWrite and collected target-file identity.

What it can establish

• Support that a command was configured under a startup mechanism at collection.

What it cannot prove

• Prove the configured target ran at a particular logon.
• Use a key’s LastWrite as the individual modification time of every value.

Use it in a screenshare

1. Collect relevant user and machine hives without editing startup values.
2. Inspect full command strings and targets using Autoruns or a registry parser. Avoid launching suspicious values to test them live.
3. Correlate a relevant logon period with process events, Prefetch or task/service evidence, distinguishing configuration from observed execution.

Worked example

A startup value points to a missing executable. This supports a retained startup configuration, which may be stale. The missing target does not establish whether the program ran in the past.

Cross-check the finding

• Scheduled Tasks →Support a task’s recorded configuration and specifically logged task actions.
• Windows services →Support an installed service configuration or a specific logged state change.
• Prefetch →Support execution of an associated executable within the retained history.

Sources

• Microsoft — Autoruns ↗