Autorunsc 14.3 Regression Could Hide Malware Persistence Entries

A reported behavioural change in Microsoft Sysinternals Autorunsc 14.3 could cause investigators to miss certain persistence mechanisms when examining Windows systems for suspicious startup activity.

According to the October 14 roundup from Forensic Focus, the change affects how Autorunsc resolves launcher targets. Signed launchers may mask unsigned persistence entries that earlier versions displayed, potentially leaving analysts with an incomplete view of programs configured to run automatically.

Autorunsc is the command-line version of Autoruns, a Microsoft utility that identifies programs configured to start during system boot or user logon. Investigators commonly use these tools to identify suspicious startup entries and investigate how malware maintains access to a compromised machine.

The reported behaviour is particularly relevant when examiners use signature-based filtering to narrow large results sets. If an entry is hidden during this process, analysts could overlook a potential persistence mechanism.

For forensic teams, the incident reinforces the importance of validating tool output rather than treating a single scan as conclusive. Investigators should preserve the original results, document the tool version and configuration, and cross-check suspicious or missing entries using alternative methods.

The report does not establish that every Autorunsc 14.3 examination is affected, or that the behaviour has already caused investigators to miss confirmed malware infections.