Adversaries may abuse features of Winlogon to execute DLLs and/or executables when a user logs in. Winlogon.exe is a Windows component responsible for actions at logon/logoff as well as the secure attention sequence (SAS) triggered by Ctrl-Alt-Delete. Registry entries inHKLM\Software[\Wow6432Node\]\Microsoft\Windows NT\CurrentVersion\Winlogon\ andHKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\ are used to manage additional helper programs and functionalities that support Winlogon.[1]
Malicious modifications to these Registry keys may cause Winlogon to load and execute malicious DLLs and/or executables. Specifically, the following subkeys have been known to be possibly vulnerable to abuse:[1]
Adversaries may take advantage of these features to repeatedly execute malicious code and establish persistence.
| ID | Name | Description |
|---|---|---|
| S0534 | Bazar | Bazar can use Winlogon Helper DLL to establish persistence.[2] |
| S0351 | Cannon | Cannon adds the Registry key |
| S1066 | DarkTortilla | DarkTortilla has established persistence via the |
| S0200 | Dipsind | ADipsind variant registers as a Winlogon Event Notify DLL to establish persistence.[5] |
| S0168 | Gazer | Gazer can establish persistence by setting the value "Shell" with "explorer.exe, %malware_pathfile%" under the Registry key |
| S0387 | KeyBoy | KeyBoy issues the command |
| S1202 | LockBit 3.0 | LockBit 3.0 can enable automatic logon through the |
| S1242 | Qilin | |
| S0375 | Remexi | Remexi achieves persistence using Userinit by adding the Registry key |
| S0379 | Revenge RAT | Revenge RAT creates a Registry key at |
| G0081 | Tropic Trooper | Tropic Trooper has created the Registry key |
| G0010 | Turla | Turla established persistence by adding a Shell value under the Registry key |
| G0102 | Wizard Spider | Wizard Spider has established persistence using Userinit by adding the Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon.[16] |
| ID | Mitigation | Description |
|---|---|---|
| M1038 | Execution Prevention | Identify and block potentially malicious software that may be executed through the Winlogon helper process by using application control[17] tools like AppLocker[18][19] that are capable of auditing and/or blocking unknown DLLs. |
| M1018 | User Account Management | Limit the privileges of user accounts so that only authorized administrators can perform Winlogon helper changes. |
| ID | Name | Analytic ID | Analytic Description |
|---|---|---|---|
| DET0404 | Detect Winlogon Helper DLL Abuse via Registry and Process Artifacts on Windows | AN1133 | Monitor Windows Registry modifications to Winlogon keys (Shell, Userinit, Notify) that introduce new executable or DLL paths. Correlate these changes with subsequent DLL loading, image loads, or process creation originating from winlogon.exe or userinit.exe. Abnormal child process lineage or unauthorized binaries in C:\Windows\System32 may indicate abuse. |