Techniques › T1547.004 › AN1133
AN1133 Analytic 1133
Windows · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Monitor Windows Registry modifications to Winlogon keys (Shell, Userinit, Notify) that introduce new executable or DLL paths. Correlate these changes with subsequent DLL loading, image loads, or process creation originating from winlogon.exe or userinit.exe. Abnormal child process lineage or unauthorized binaries in C:\Windows\System32 may indicate abuse.</p>
- Detects
- T1547.004 Winlogon Helper DLL
- Part of
- DET0404 Detect Winlogon Helper DLL Abuse via Registry and Process Artifacts on Windows
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| WinEventLog:Sysmon | EventCode=7 | DC0016 Module Load |
| WinEventLog:Sysmon | EventCode=1 | DC0032 Process Creation |
| WinEventLog:Security | modification to Winlogon registry keys such as Shell, Notify, or Userinit | DC0063 Windows Registry Key Modification |
| Autoruns:RegistryScan | Enumerate Winlogon subkeys for unknown or unsigned binaries | DC0050 Windows Registry Key Access |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
TimeWindow | Time correlation between registry modification and malicious module load or process creation |
UserContext | Privilege level or user context under which registry changes or process executions occur |
BinarySignatureValidation | Whether to validate binary signatures when DLLs are loaded via Winlogon helper paths |
ExecutablePathScope | Scope of directories considered suspicious for helper DLLs (e.g., temp paths, non-System32 locations) |