Wizard SpiderG0102 ↗
Has established persistence using Userinit by adding the Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon.1
tfMITRE ATT&CK sub-technique
Winlogon Helper DLL T1547.004
sub-technique of T1547 Boot or Logon Autostart Execution
- Tactics
- Persistence, Privilege Escalation
- Platform
- Windows
- Version
- 1.3
- Created
- 24 January 2020
- Last modified
- 24 October 2025
- Contributor
- Praetorian
Adversaries may abuse features of Winlogon to execute DLLs and/or executables when a user logs in. Winlogon.exe is a Windows component responsible for actions at logon/logoff as well as the secure attention sequence (SAS) triggered by Ctrl-Alt-Delete. Registry entries in HKLM\Software[\\Wow6432Node\\]\Microsoft\Windows NT\CurrentVersion\Winlogon\ and HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\ are used to manage additional helper programs and functionalities that support Winlogon.[1]
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
3
Threat groups64th pct
Threat groups64th percentile · 64% of ATT&CK techniques have this many threat groups attributed or fewer.0
CampaignsNone recorded
CampaignsNone recorded · 54% of ATT&CK techniques have none either.10
Tools & malware74th pct
Tools & malware74th percentile · 74% of ATT&CK techniques have this many tools implementing them or fewer.4
Detection rules60th pct
Detection rules60th percentile · 60% of ATT&CK techniques have this many detection rules written or fewer.Winlogon Helper DLL MITRE reference T1547.004
64th pctamong all ATT&CK techniques for number of groups
3 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
Tropic TrooperG0081 ↗
Has created the Registry key HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell and sets the value to establish persistence.12
TurlaG0010 ↗
Established persistence by adding a Shell value under the Registry key HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon.1
All 3 groups for this technique
10 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
QilinS1242 ↗
Can configure a Winlogon registry entry.1
LockBit 3.0S1202 ↗
Can enable automatic logon through the SOFTWARE\Microsoft\Windows
NT\CurrentVersion\Winlogon Registry key.1
DarkTortillaS1066 ↗
Has established persistence via the Software\Microsoft\Windows NT\CurrentVersion\Winlogon registry key.1
BazarS0534 ↗
Can use Winlogon Helper DLL to establish persistence.1
KeyBoyS0387 ↗
Issues the command reg add “HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon” to achieve persistence.1 2
Revenge RATS0379 ↗
Creates a Registry key at HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell to survive a system reboot.1
All 10 software entries for this technique · 6 newest in this preview
Offense vs defense T1547.004
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
How it got here
Range
Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.
Campaigns · 0Sigma rules (cumulative) · 4Splunk ESCU (cumulative) · 0
first rule: 2019 Q4Winlogon Helper DLL detection strategy DET0404
MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Detect Winlogon Helper DLL Abuse via Registry and Process Artifacts on Windows
1 platform
AN1133 · Windows
Monitor Windows Registry modifications to Winlogon keys (Shell, Userinit, Notify) that introduce new executable or DLL paths. Correlate these changes with subsequent DLL loading, image loads, or process creation originating from winlogon.exe or userinit.exe. Abnormal child process lineage or unauthorized binaries in C:\Windows\System32 may indicate abuse.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Module LoadDC0016 | WinEventLog:Sysmon | EventCode=7 |
| Process CreationDC0032 | WinEventLog:Sysmon | EventCode=1 |
| Windows Registry Key AccessDC0050 | Autoruns:RegistryScan | Enumerate Winlogon subkeys for unknown or unsigned binaries |
| Windows Registry Key ModificationDC0063 | WinEventLog:Security | modification to Winlogon registry keys such as Shell, Notify, or Userinit |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| TimeWindow | Time correlation between registry modification and malicious module load or process creation |
| UserContext | Privilege level or user context under which registry changes or process executions occur |
| BinarySignatureValidation | Whether to validate binary signatures when DLLs are loaded via Winlogon helper paths |
| ExecutablePathScope | Scope of directories considered suspicious for helper DLLs (e.g., temp paths, non-System32 locations) |
2 analytics
The Sysinternals tool Autoruns checks the registry and file system for known identify persistence mechanisms. It will output any tools identified, including built-in or added-on Microsoft functionality and third party software. Many of these locations are known by adversaries and used to obtain Persistence. Running Autoruns periodically in an environment makes it possible to collect and monitor its output for differences, which may include the removal or addition of persistent tools. Depending on the persistence mechanism and location, legitimate software may be more likely to make changes than an adversary tool. Thus, this analytic may result in significant noise in a highly dynamic environment. While Autoruns is a convenient method to scan for programs using persistence mechanisms its scanning nature does not conform well to streaming based analytics. This analytic could be replaced with one that draws from sensors that collect registry and file information if streaming analytics are desired.
D3FEND techniques
The defensive countermeasure this analytic implements, in MITRE’s D3FEND ontology.
| ID | Name |
|---|---|
| D3-SICA | System Init Config Analysis |
Detection of modification of the registry key values of Notify, Userinit, and Shell located in HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\ and HKEY_LOCAL_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\. When a user logs on, the Registry key values of Notify, Userinit and Shell are used to load dedicated Windows component. Attackers may insert malicious payload following the legitimate value to launch a malicious payload.
D3FEND techniques
The defensive countermeasure this analytic implements, in MITRE’s D3FEND ontology.
| ID | Name |
|---|---|
| D3-PSA | Process Spawn Analysis |
Data model references
The CAR data model objects, actions and fields the logic reads. Map these to your own schema before implementing.
| Object | Action | Field |
|---|---|---|
| process | create | command_line |
| registry | add | key |
Implementations
Pseudocode is the canonical logic; the rest are CAR’s translations into vendor query languages.
This detects logon registry key modification, either via a new process (command line) or direct registry manipulation.
processes = search Process:create
logon_reg_processes = filter processes where command_line CONTAINS("*\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon*") AND (command_line CONTAINS("*Userinit*") OR command_line CONTAINS("*Shell*") OR command_line CONTAINS("*Notify*")) AND (((command_line CONTAINS("*reg*") OR command_line CONTAINS("*add*") OR command_line CONTAINS("*/d*")) OR (command_line CONTAINS("*Set-ItemProperty*") OR command_line CONTAINS("*New-ItemProperty*") OR command_line CONTAINS("*-value*"))))
reg_keys = search Registry:value_edit
logon_reg_keys = filter reg_keys where (value="Userinit" OR value="Shell" OR value="Notify")
output logon_reg_processes, logon_reg_keys
This is a Splunk representation of the above pseudocode.
(((((EventCode="4688" OR EventCode="1") ((CommandLine="*reg*" CommandLine="*add*" CommandLine="*/d*") OR ((CommandLine="*Set-ItemProperty*" OR CommandLine="*New-ItemProperty*") CommandLine="*-value*")) CommandLine="*\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon*" (CommandLine="*Userinit*" OR CommandLine="*Shell*" OR CommandLine="*Notify*")) OR ((EventCode="4657") (ObjectValueName="Userinit" OR ObjectValueName="Shell" OR ObjectValueName="Notify"))) OR ((EventCode="13") (TargetObject="*Userinit" OR TargetObject="*Shell" OR TargetObject="*Notify"))))
This is an ElasticSearch representation of the above pseudocode.
(((EventCode:("4688" OR "1") AND ((process.command_line:*reg* AND process.command_line:*add* AND process.command_line:*\/d*) OR (process.command_line:(*Set\-ItemProperty* OR *New\-ItemProperty*) AND process.command_line:*\-value*)) AND process.command_line:*\\Microsoft\\Windows\ NT\\CurrentVersion\\Winlogon* AND process.command_line:(*Userinit* OR *Shell* OR *Notify*)) OR (EventCode:"4657" AND winlog.event_data.ObjectValueName:("Userinit" OR "Shell" OR "Notify"))) OR (EventCode:"13" AND winlog.event_data.TargetObject:(*Userinit OR *Shell OR *Notify)))
This is a LogPoint representation of the above pseudocode.
(((EventCode IN ["4688", "1"] ((CommandLine="*reg*" CommandLine="*add*" CommandLine="*/d*") OR (CommandLine IN ["*Set-ItemProperty*", "*New-ItemProperty*"] CommandLine="*-value*")) CommandLine="*\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon*" CommandLine IN ["*Userinit*", "*Shell*", "*Notify*"]) OR (EventCode IN "4657" ObjectValueName IN ["Userinit", "Shell", "Notify"])) OR (EventCode IN "13" TargetObject IN ["*Userinit", "*Shell", "*Notify"]))
Unit tests
CAR’s own validation procedures for this analytic.
Modification on Registry Key with cmd. Calc.exe will be launched when user will login
["reg add \"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\" /v Userinit /d C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\calc.exe"]
Modification on Registry Key with Powershell. Calc.exe will be launched when user will login
["Set-ItemProperty -Path \"HKLM:\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\" -Name Userinit -Value C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\calc.exe"]
Execution PreventionM1038
Identify and block potentially malicious software that may be executed through the Winlogon helper process by using application control tools like AppLocker that are capable of auditing and/or blocking unknown DLLs.
Limit the privileges of user accounts so that only authorized administrators can perform Winlogon helper changes.
Tests5ExecutorsPowerShell 5Need elevation0 of 5Have prerequisites0Have cleanup5Platformswindows
Tests from Atomic Red Team (MIT licence) · technique definition