> For the complete documentation index, see [llms.txt](https://windows.dfirhandbook.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://windows.dfirhandbook.com/windows-artifacts/persistence/registry/run-and-run-once.md).

# Run and Run Once

#### Run and RunOnce Keys: An Overview

* **Run Keys**: These keys launch programs at system startup or user logon. Values under these keys execute every time the system boots or the user signs in. Common locations include:

  * `HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run`
  * `HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run`

  Values under `HKEY_LOCAL_MACHINE` run for all users. Values under `HKEY_CURRENT_USER` run only for the signed-in user.
* **RunOnce Keys**: These keys work like `Run` keys, but Windows executes each value only once at the next startup or logon, then removes it from the Registry. **They are not a durable persistence mechanism, but they can still be abused for one-time execution.** Common locations include:
  * `HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce`
  * `HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce`

#### Legitimate Uses

Legitimately, software developers use these keys to ensure necessary services and applications start automatically to provide a seamless user experience. For example, antivirus software might use `Run` keys to start protection services at boot time, or an installer might use `RunOnce` to complete setup tasks the next time the computer starts.

#### Abuse by Threat Actors

Threat actors exploit these keys to establish persistence for their malware. By inserting malicious paths into these keys, they can ensure their malware executes each time the computer starts or when a user logs on. This technique is commonly used because it is straightforward and effective, especially for maintaining long-term access to a compromised system.

#### Examples of Suspicious Entries

A suspicious entry in a `Run` or `RunOnce` key might look like this:

* A program executing from a temporary or unusual directory, e.g.,

  ```powershell
  HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
  "SecurityUpdate"="C:\Users\user\AppData\Local\Temp\update.exe"
  ```
* Entries with obfuscated or random names, which do not match known software, e.g.,

  ```powershell
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
  "kjhfgds"="C:\Windows\System32\kjhfgds.exe"
  ```
* Paths that include known locations for malware persistence or unusual script execution, e.g.,

  ```powershell
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
  "CustomScript"="powershell.exe -ExecutionPolicy Bypass -File C:\Users\user\Documents\script.ps1"
  ```

#### Detection and Analysis

For digital forensic analysts, identifying suspicious or unknown entries in these keys is crucial. Tools such as `autoruns` from Sysinternals can be used to inspect these locations efficiently. Analysts should look for entries that do not correspond to installed software, that reference executables in unusual locations, or that appear to use obfuscation techniques. Verifying the legitimacy of each entry and conducting further investigation on unknown or suspicious items is essential for identifying and mitigating potential threats.

In summary, while `Run` and `RunOnce` keys serve important functions in Windows OS for legitimate software, they are also common targets for abuse by threat actors seeking to maintain persistence on compromised systems. Identifying and investigating unusual or unknown entries in these Registry locations is a critical task for security professionals and digital forensic analysts to prevent and mitigate malicious activities.