thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Security Operations · Intermediate

Registry Run Keys

Windows registry locations that automatically launch programs at user logon or system boot.

Definition

Common keys include HKLM and HKCU Software\Microsoft\Windows\CurrentVersion\Run and RunOnce. Attackers add entries for persistence (ATT&CK T1547.001). Sysinternals Autoruns lists these and many other autostart locations.

Example

reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Updater /d C:\Users\Public\up.exe

Exam tip

Autoruns is the go-to tool for reviewing autostart persistence.

Related terms