Module 6 — Applications, Services, and Autoruns

Path: Module 5 · Next: Module 7

0. Purpose

Distinguish interactive apps from background machinery. Persistence hunts and hardening reviews both require the startup graph.

1. ELI5

• Application — you open it (Notepad, Edge)
• Service — invisible worker started by Windows, often as svchost.exe or its own .exe
• Scheduled task — alarm clock that runs a program
• Autorun — "start this when I log in" sticky notes in the registry or Startup folder

Attackers love alarms and sticky notes because they survive reboot.

2. Deep breakdown

flowchart TD
  BOOT[Boot / logon] --> SVC[Services SCM]
  BOOT --> TASK[Task Scheduler]
  BOOT --> RUN[Run / RunOnce keys]
  BOOT --> STARTUP[Startup folders]
  SVC --> SVCHOST[svchost.exe or service.exe]
  TASK --> PROC[Child process]
  RUN --> PROC
  STARTUP --> PROC

Services vs processes

• A service is a configuration object in SCM
• It runs inside a process (services.exe hosts SCM; work happens in svchost or standalone binary)
• Always verify: service name → binary path → signature

Get-Service | Where-Object Status -eq 'Running' |
  Select-Object -First 10 Name, DisplayName, Status

Win11 modern apps

Store / MSIX packages live under C:\Program Files\WindowsApps\ (protected) with registry under Appx keys — different inspection path than classic Win32.

Lab .114 security services (baseline)

Persistence Event IDs (Security log)

Lab audit: Run keys empty; non-Microsoft tasks include Edge update, OneDrive, SoftLanding.

Task XML location

Scheduled task definitions persist as XML under C:\Windows\System32\Tasks\ — useful when GUI hides details.

Security engineer lens

Hardening: least-privilege service accounts, restrict who can create tasks, audit 4697/4698/7045 where enabled.

Lab checkpoint — 192.168.50.114

# Running services (sample)
Get-Service | Where-Object Status -eq 'Running' |
  Sort-Object DisplayName |
  Select-Object -First 15 Name, DisplayName, StartType

# Scheduled tasks (non-Microsoft sample — may be long)
Get-ScheduledTask |
  Where-Object { $_.TaskPath -notmatch 'Microsoft' } |
  Select-Object -First 10 TaskName, TaskPath, State

# Current user Run keys
$paths = @(
  'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run',
  'HKLM:\Software\Microsoft\Windows\CurrentVersion\Run'
)
foreach ($p in $paths) {
  if (Test-Path $p) {
    Write-Output "=== $p ==="
    Get-ItemProperty $p -ErrorAction SilentlyContinue
  }
}

Install Autoruns on the lab VM when ready — export a baseline .arn for diffing later. Installed: C:\Tools\Sysinternals\Autoruns64.exe — see 23-lab-tools-inventory.

Record in notebook

• Difference between service and process (one sentence)
• Count of running services on .114 (order of magnitude)
• One scheduled task name you recognize as legitimate

Navigation

← Module 5 · Module 7 →