MITRE ATT&CK technique · Persistence, Privilege Escalation

`T1547.004` Winlogon Helper DLL

Sub-technique of T1547 Boot or Logon Autostart Execution

Adversaries may abuse features of Winlogon to execute DLLs and/or executables when a user logs in. Winlogon.exe is a Windows component responsible for actions at logon/logoff as well as the secure attention sequence (SAS) triggered by Ctrl-Alt-Delete. Registry entries in HKLM\Software[\\Wow6432Node\\]\Microsoft\Windows NT\CurrentVersion\Winlogon\ and HKCU\Software\Microsoft\Windows…

MITRE ATT&CK page ↗

Who uses it · with stories on Jábega

Qilin

Sigma rules to hunt it

Winlogon Notify Key Logon Persistencehightest · windows
MITRE BZAR Indicators for Persistencemediumtest · zeek
Winlogon Helper DLLmediumtest · windows
TanStack Supply-Chain Attack File Creation Indicators - Linuxmediumexperimental · linux

Rules from SigmaHQ · Detection Rule License 1.1. Technique from MITRE ATT&CK®.