How can an attacker bypass Autoruns detection by simulating a trusted directory?

An attacker can create a simulated trusted directory (e.g., `\\?\c:\windows ` with a trailing space) and place a malicious executable like `putty.exe` under a legitimate name (e.g., `notepad.exe`). By registering that path in startup locations such as Userinit or LSA Providers, Autoruns sees the file name as a Microsoft-signed executable and hides it by default. This technique, detailed in [Expansion of Techniques for Exploiting Simulated Trusted Directories](/news/expansion-of-techniques-for-exploiting-simulated-trusted-directories), allows the malicious payload to run at startup without appearing in Autoruns' default view.