RunOnce and run key clearing artifact detector — free browser tool | fatcousin

home

drop security evtx csv or registry export · detect run and runonce key value deletion · identify persistence mechanism removal · surface autorun entries that existed and were then deleted during the investigation window · runs locally

inputs

drop security evtx csv, .reg diff, or autoruns csv (multi-file)

or click

Select file

4657/4660 on Run · RunOnce · RunOnceEx · Winlogon · before/after .reg or paired autoruns csv · RunOnce expected vs manual deletion

attack window start (optional) attack window end (optional)

drop security evtx csv, registry diff, or autoruns csv snapshots