commandprocautorun#
$ target-query <path/to/target> -f commandprocautorun
Module |
|
Output |
|
Module documentation
Generic Windows plugin.
Provides some plugins that don’t fit in a separate plugin.
Function documentation
Return all available Command Processor (cmd.exe) AutoRun registry key values.
The Command Processor AutoRun registry key values contain commands that are run each time the Command Processor (cmd.exe) is started. Since these commands are not shown to the user in the Command Processor, it can be exploited by an adversary to hide malicious commands or leverage as a persistence mechanism