What is a malicious startup item?¶
A malicious startup item is a file, shortcut, setting or configuration used to launch code automatically when a system or user session starts.
Avoid the dangerous assumption¶
The dangerous assumption is that every unfamiliar startup entry is malware.
Many legitimate applications start automatically.
Investigators should identify:
- the startup location
- entry name
- target command or file
- creation and modification time
- user or system scope
- creator account or process
- execution history
- associated network or file activity.
Startup mechanisms vary across operating systems and applications.
They may include startup folders, login items, registry entries, shell profiles, application launch agents or boot configuration.
The presence of the entry does not prove it executed.
The system or user may not have restarted or logged in after creation.
Likewise, execution does not automatically prove malicious purpose.
Preserve the entry and target file before removal.
Check whether the target remains present and whether it was altered after the entry was created.
A startup item may run under the user’s normal privilege or a higher system context.
The name may imitate a legitimate application or system component.
Startup evidence should be correlated with actual login or boot events. If the relevant user never logged in, or the system never restarted, the mechanism may have existed without running during the period under investigation.
Where several users share the system, identify which profile owned the startup entry and whether another account could modify it.
Operational takeaway¶
Preserve the startup entry, target and creation context, and prove execution and malicious use separately from automatic-start capability.