T1547.004 Winlogon Helper DLL
Subtécnica de T1547 Boot or Logon Autostart Execution
Adversaries may abuse features of Winlogon to execute DLLs and/or executables when a user logs in. Winlogon.exe is a Windows component responsible for actions at logon/logoff as well as the secure attention sequence (SAS) triggered by Ctrl-Alt-Delete. Registry entries in HKLM\Software[\\Wow6432Node\\]\Microsoft\Windows NT\CurrentVersion\Winlogon\ and HKCU\Software\Microsoft\Windows…
Quién la usa · con noticias en Jábega
Reglas Sigma para cazarla
- Winlogon Notify Key Logon Persistencehightest · windows
- MITRE BZAR Indicators for Persistencemediumtest · zeek
- Winlogon Helper DLLmediumtest · windows
- TanStack Supply-Chain Attack File Creation Indicators - Linuxmediumexperimental · linux
Reglas de SigmaHQ · Detection Rule License 1.1. Técnica de MITRE ATT&CK®.