WinEventLog Autoruns
Autoruns is a tool developed by Sysinternals that allows you to view all of the locations in Windows where applications can insert themselves to launch at boot or when certain applications are opened. Malware often takes advantages of these locations to ensure that it runs whenever your computer boots up. The script can be downloaded from https://github.com/palantir/windows-event-forwarding/tree/master/AutorunsToWinEventLog
More about Autoruns at: https://technet.microsoft.com/en-us/sysinternals/bb963902.aspx
Installation
From an Admin Powershell Console run .\Install.ps1. The script will:
·	Create a directory at c:\Program Files\AutorunsToWinEventLog to store and forward all logs
·	Copy over AutorunsToWinEventLog.ps1 to the same directory
·	Download Autorunsc64.exe from https://live.sysinternals.com
·	Create a scheduled task to run the install script daily at 1100
To run the task without waiting, open scheduled tasks library and execute it from there.
What Does AutorunsToWinEventLog do
Autoruns conveniently includes a non-interactive command line utility. This code generates a CSV of Autoruns entries, converts them to JSON, and finally inserts them into a custom Windows Event Log. By doing this, we can take advantage of our existing WEF infrastructure to get these entries into our SIEM and start looking for signs of malicious persistence on endpoints and servers.