
title: Winlogon Helper DLL
author: Timur Zinniatullin, oscd.community
date: 2019/10/21
description: Winlogon.exe is a Windows component responsible for actions at logon/logoff
  as well as the secure attention sequence (SAS) triggered by Ctrl-Alt-Delete. Registry
  entries in HKLM\Software[Wow6432Node]Microsoft\Windows NT\CurrentVersion\Winlogon\
  and HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\ are used to manage
  additional helper programs and functionalities that support Winlogon. Malicious
  modifications to these Registry keys may cause Winlogon to load and execute malicious
  DLLs and/or executables.
detection:
  SELECTION_1:
    ScriptBlockText: '*CurrentVersion\Winlogon*'
  SELECTION_2:
    ScriptBlockText:
    - '*Set-ItemProperty*'
    - '*New-Item*'
  condition: (SELECTION_1 and SELECTION_2)
falsepositives:
- Unknown
id: 851c506b-6b7c-4ce2-8802-c703009d03c0
level: medium
logsource:
  category: ps_script
  definition: Script block logging must be enabled
  product: windows
modified: 2021/10/16
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1547.004/T1547.004.md
status: experimental
tags:
- attack.persistence
- attack.t1547.004
- attack.t1004
ruletype: SIGMA
