AutorunScan.psd1
|
@{ RootModule = 'AutorunScan.psm1' ModuleVersion = '1.0.0' GUID = 'e0c75746-a28d-4971-a335-9a4071e586a2' Author = 'dooblpls' CompanyName = 'dooblpls' Copyright = '(c) 2026 dooblpls. MIT License.' Description = 'Enumerates all known Windows autostart / persistence locations (everything Sysinternals Autoruns covers plus COM hijacks, UAC bypass hijacks, PowerShell profiles, browser extensions, BITS, hidden scheduled tasks and more) and maps every entry to MITRE ATT&CK. Pure PowerShell, no external binaries.' PowerShellVersion = '5.1' CompatiblePSEditions = @('Desktop', 'Core') FunctionsToExport = @('Get-Autorun', 'Resolve-AutorunImage') CmdletsToExport = @() VariablesToExport = @() AliasesToExport = @() PrivateData = @{ PSData = @{ Tags = @('Autoruns', 'Persistence', 'MITRE', 'ATTACK', 'DFIR', 'ThreatHunting', 'Forensics', 'IncidentResponse', 'Security', 'Windows', 'PSEdition_Desktop', 'PSEdition_Core') LicenseUri = 'https://github.com/dooblpls/AutorunScan/blob/main/LICENSE' ProjectUri = 'https://github.com/dooblpls/AutorunScan' ReleaseNotes = 'Initial release.' } } } |