REFERENCE GUIDE
Registry and startup configuration evidence
The registry stores configuration, including startup and service-related settings.
Also known as: autoruns · Run keys
Mechanism
The registry stores configuration, including startup and service-related settings. A startup entry matters when its execution principal, trigger, referenced path, and write permissions combine into a usable boundary crossing. Finding a familiar Run key or autorun location is not sufficient without checking who consumes it and when.
Practical method
Inspect relevant values without changing them. Resolve environment expansions and quoted paths. Check ACLs on both the registry key and referenced files. Determine whether the trigger is logon, boot, service start, or application launch, and which identity will execute the target.
Get-ItemProperty HKCU:\Software\Microsoft\Windows\CurrentVersion\Run
Get-Acl HKCU:\Software\Microsoft\Windows\CurrentVersion\RunInterpreting evidence
Document the complete command after expansion and its triggering context. A per-user startup entry usually runs with that user rather than a system identity.
Pitfalls and limits
32-bit and 64-bit registry views can differ. Some changes require a future login. Security products or policy can disable an entry without removing its stored value.