..
    generated, remove this comment to keep this file

``runkeys``
===========

.. code-block:: console

    $ target-query <path/to/target> -f runkeys


.. list-table:: Details
    :widths: 20 80

    * - Module
      - ``os.windows.regf.runkeys.RunKeysPlugin``
    * - Output
      - ``records``

**Module documentation**

Plugin that iterates various Runkey locations.

**Function documentation**

Iterate various run key locations. See source for all locations.

Run keys (Run and RunOnce) are registry keys that make a program run when a user logs on. a Run key runs every
time the user logs on and the RunOnce key makes the program run once and deletes the key after. Often leveraged
as a persistence mechanism.

References:
    - https://docs.microsoft.com/en-us/windows/win32/setupapi/run-and-runonce-registry-keys

Yields RunKeyRecords with fields:
    hostname (string): The target hostname.
    domain (string): The target domain.
    ts (datetime): The registry key last modified timestamp.
    name (string): The run key name.
    command (command): The run key command.
    key (string): The source key for this run key.