Struct RunKeyEntry 

pub struct RunKeyEntry {
    pub hive: String,
    pub key_path: String,
    pub value_name: String,
    pub command: String,
    pub is_suspicious: bool,
    pub suspicious_reason: Option<String>,
    pub last_written: Option<DateTime<Utc>>,
}

A single autorun entry extracted from a registry hive.

Fields

hive: String

Hive origin: "HKLM" for SOFTWARE, "HKCU" for NTUSER.DAT, or "UNKNOWN" for unrecognised hive types.

key_path: String

Full registry key path (relative to hive root).

value_name: String

Value name (the persistence entry identifier).

command: String

Value data: the command or path that runs at startup.

is_suspicious: bool

true if the command matches a known LOLBin abuse pattern.

suspicious_reason: Option<String>

Human-readable explanation when is_suspicious is true.

last_written: Option<DateTime<Utc>>

The Run key’s LastWriteTime — approximately when this autorun entry was last written. None when the key carries no timestamp.

Trait Implementations

impl Clone for RunKeyEntry

fn clone(&self) -> RunKeyEntry

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for RunKeyEntry

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Serialize for RunKeyEntry

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.