T1547.004 — Winlogon Helper DLL

Tactics: Persistence, Privilege Escalation · Platforms: Windows

Adversaries may abuse features of Winlogon to execute DLLs and/or executables when a user logs in. Winlogon.exe is a Windows component responsible for actions at logon/logoff as well as the secure attention sequence (SAS) triggered by Ctrl-Alt-Delete. Registry entries in…

Sub-technique of Boot or Logon Autostart Execution (T1547).

Sigma detection rules (1)

T1547.004 Boot or Logon Autostart Execution: Winlogon Helper DLL

title: "T1547.004 Boot or Logon Autostart Execution: Winlogon Helper DLL"
id: fb22976c-8e1b-432b-a11e-d899df5af175
description: 'Detect Winlogon Helper DLL Abuse via Registry Modification of Winlogon Notify/Userinit/Shell Keys. (Data Component: Module Load; baseline tier: windows-eventid.) Tune using: TimeWindow, UserContext, BinarySignatureValidation, ExecutablePathScope.'
references:
  - https://attack.mitre.org/techniques/T1547/004
author: Shahrukh Khan
date: 2026-05-26
license: MIT
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.t1547.004

logsource:
  category: registry_set
  product: windows
  service: sysmon

detection:
  selection:
    EventID:
      - '13'
      - '14'
    TargetObject|contains:
      - '\Winlogon\Notify'
      - '\Winlogon\Userinit'
      - '\Winlogon\Shell'
      - '\Winlogon\TaskMan'
      - '\Winlogon\GinaDLL'
  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'
  condition: selection and not filter_system_account

falsepositives:
  - Third-party credential provider or shell-replacement software legitimately registering these values.

level: medium

Related sub-techniques

Explore