Autoruns

Overview

Worm:Win32/Autoruns (often flagged generically as `autorun.inf` malware) represents a massive class of self-replicating malware that abuses the legacy Windows 'AutoRun' or 'AutoPlay' feature. While Microsoft has heavily restricted this feature in modern OS versions, Autoruns remains a critical vector for infecting air-gapped networks and industrial control systems (ICS) via USB flash drives.

Understanding Autoruns
To an end-user, an Autoruns infection might look like an innocent USB drive containing a folder named 'Passwords' or a document that is actually a disguised executable. For security analysts, Autoruns is a highly efficient lateral movement mechanism. The malware specifically targets removable media (`T1091`), writing a hidden executable and a weaponized `autorun.inf` file to the root directory of the drive.

Execution and Lateral Movement Mechanics
Historically, simply inserting the USB drive would cause the OS to parse the `autorun.inf` file and silently execute the referenced malware (`T1059`). Even with modern mitigations (where auto-execution is disabled), the malware uses social engineering: it hides the legitimate files on the USB and replaces them with shortcuts (`.lnk` files) or executables using folder icons (`T1036.004`). When the victim double-clicks the 'folder' to view their files, the malware executes, infects the host machine, and immediately begins scanning for newly inserted USB drives to infect.

Indicators of Compromise & Impact
The impact is the bridging of network perimeters (e.g., Stuxnet used this exact technique). EDR platforms must alert on processes executing directly from the root of a removable drive (`D:\malware.exe`). The presence of hidden `autorun.inf` files containing `open=` or `shellexecute=` directives on flash drives is the definitive IoC. Systemic infection indicates a failure in USB Device Control policies.

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to the MITRE ATT&CK framework:

Tactical Mitigations

Based on the techniques used by this family, consider the following defensive strategies:

• T1036.004: Monitor for executable files running from unusual paths or with deceptive names. Use EDR to detect process masquerading.
• T1059: Restrict execution of scripting languages such as PowerShell, VBScript, or Python to authorized administrators. Enforce Script Block Logging.

Generated Detections (Boilerplate)

These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.

YARA Rule

rule MALWARE_WIN_AUTORUNS {
    meta:
        description = "Detects Autoruns (advanced_threat)"
        author = "SystemHelpdesk Boilerplate Generator"
        date = "2026-07-06"
    strings:
        $s1 = "autoruns" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

Sigma Rule

title: Suspicious Autoruns Activity
id: 48315613a64cd5b6abcec1c580f95dce
status: experimental
description: Detects generic indicators of the autoruns malware family.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
        CommandLine|contains:
            - "*autoruns*"
    condition: selection
level: medium

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Immediately disconnect the infected machine from the network and confiscate any USB drives currently plugged into the system.
2. Deploy an enterprise-wide GPO to strictly disable AutoPlay and AutoRun functionality across all drives (not just removable media).
3. Implement a strict Device Control policy via EDR to block unauthorized USB mass storage devices from mounting.
4. Scan the confiscated USB drives on an isolated forensic workstation to extract and analyze the original `autorun.inf` drop file.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not plug an infected or unknown USB drive into a networked, production machine for analysis; use an isolated sandbox.
2. Avoid assuming modern Windows completely stops this threat; the malware relies heavily on socially engineering the user into clicking fake folder icons.

References & External Analysis

• Search "autoruns" on VirusTotal (External Analysis)

Frequently Asked Questions

Related Families (Category: advanced_threat)

Explore other malware families in the same category:

• Babylon
• Allinonekeylogger
• Extinstaller
• Gotango
• Onescan

Machine-readable

Get this profile as JSON: https://jordan123234-malware-families-explorer.static.hf.space/api/autoruns.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.