Hunting CurrentVersion Run Key and Startup events
Hunting startup events can be tricky but rewarding. There are a lot of events which makes filtering difficult and there are some tricks to isolating the data. One way is to look at the registry keys and directories being written too but for hunting I assume that there are some past events that were missed. Here is a method of profiling the events at run time. For events from currentversion/run or start menu events the parent will be explorer.exe and the grandparent will be userinit.exe . But, they need to occur in a smallish time from after userinit executes. This example is limiting the results to keywords .vbs .wsf .bat, but we can look for all sorts of interesting things, hta files, powershell, temp directory, etc. Run key or Start Menu .vbs .wsf .bat index=edr procstart ( userinit.exe explorer.exe parent_path=*\\userinit.exe ) OR ( explorer.exe parent_path=*\\explorer.exe ( .vbs OR .wsf OR .bat ) NOT ( [put filters here] )) | bucket _time span=5m | stats values(comma