{"id":"T1547.004","name":"Winlogon Helper DLL","url":"https://attack.mitre.org/techniques/T1547/004","tactics":["persistence","privilege-escalation"],"platforms":["Windows"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0404","stix_id":"x-mitre-detection-strategy--63135c50-7c7a-4a44-a053-28abd2388f21","name":"Detect Winlogon Helper DLL Abuse via Registry and Process Artifacts on Windows","url":"https://attack.mitre.org/detectionstrategies/DET0404","analytics":[{"id":"AN1133","stix_id":"x-mitre-analytic--e8569cdc-a018-4eee-95d9-5979cebae519","name":"Analytic 1133","description":"Monitor Windows Registry modifications to Winlogon keys (Shell, Userinit, Notify) that introduce new executable or DLL paths. Correlate these changes with subsequent DLL loading, image loads, or process creation originating from winlogon.exe or userinit.exe. Abnormal child process lineage or unauthorized binaries in C:\\Windows\\System32 may indicate abuse.","url":"https://attack.mitre.org/detectionstrategies/DET0404#AN1133","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Sysmon","channel":"EventCode=7","data_component":"DC0016","data_component_name":"Module Load","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Sysmon","channel":"EventCode=1","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Security","channel":"modification to Winlogon registry keys such as Shell, Notify, or Userinit","data_component":"DC0063","data_component_name":"Windows Registry Key Modification","log_source_slug":"wineventlog-security"},{"name":"Autoruns:RegistryScan","channel":"Enumerate Winlogon subkeys for unknown or unsigned binaries","data_component":"DC0050","data_component_name":"Windows Registry Key Access","log_source_slug":"autoruns-registryscan"}],"mutable_elements":[{"field":"TimeWindow","description":"Time correlation between registry modification and malicious module load or process creation"},{"field":"UserContext","description":"Privilege level or user context under which registry changes or process executions occur"},{"field":"BinarySignatureValidation","description":"Whether to validate binary signatures when DLLs are loaded via Winlogon helper paths"},{"field":"ExecutablePathScope","description":"Scope of directories considered suspicious for helper DLLs (e.g., temp paths, non-System32 locations)"}],"live":true,"detection_strategies":["DET0404"],"techniques":["T1547.004"]}],"live":true,"version":"1.0","techniques":["T1547.004"]}],"sigma_rules":[{"id":"2b5e4d3f-7c9a-4fab-a8d1-3e6f5a7b8c9d","title":"TanStack Supply-Chain Attack File Creation Indicators - Linux","author":"Leonardo Gasparini","status":"experimental","level":"medium","date":"2026-05-12","modified":null,"description":"Detects file creation indicators associated with the Mini Shai-Hulud supply-chain campaign targeting TanStack npm packages and others such as mistralai and uipath reported on early May 2026.","references":["https://www.netskope.com/blog/shai-hulud-style-npm-worm-hits-tanstack","https://socket.dev/blog/tanstack-npm-packages-compromised-mini-shai-hulud-supply-chain-attack","https://socket.dev/supply-chain-attacks/mini-shai-hulud","https://safedep.io/mass-npm-supply-chain-attack-tanstack-mistral/"],"logsource":{"product":"linux","category":"file_event"},"tags":["attack.initial-access","attack.t1195.002","attack.execution","attack.t1059.007","attack.persistence","attack.privilege-escalation","attack.t1547.004","detection.emerging-threats"],"path":"rules-emerging-threats/2026/Malware/TanStack-Supply-Chain/file_event_lnx_malware_tanstack_supply_chain.yml","techniques":["T1195.002","T1059.007","T1547.004"],"cves":[]},{"id":"53389db6-ba46-48e3-a94c-e0f2cefe1583","title":"MITRE BZAR Indicators for Persistence","author":"@neu5ron, SOC Prime","status":"test","level":"medium","date":"2020-03-19","modified":"2021-11-27","description":"Windows DCE-RPC functions which indicate a persistence techniques on the remote system. All credit for the Zeek mapping of the suspicious endpoint/operation field goes to MITRE.","references":["https://github.com/mitre-attack/bzar#indicators-for-attck-persistence"],"logsource":{"product":"zeek","service":"dce_rpc"},"tags":["attack.privilege-escalation","attack.persistence","attack.t1547.004"],"path":"rules/network/zeek/zeek_dce_rpc_mitre_bzar_persistence.yml","techniques":["T1547.004"],"cves":[]},{"id":"851c506b-6b7c-4ce2-8802-c703009d03c0","title":"Winlogon Helper DLL","author":"Timur Zinniatullin, oscd.community","status":"test","level":"medium","date":"2019-10-21","modified":"2022-07-07","description":"Winlogon.exe is a Windows component responsible for actions at logon/logoff as well as the secure attention sequence (SAS) triggered by Ctrl-Alt-Delete.\nRegistry entries in HKLM\\Software[Wow6432Node]Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\ and HKCU\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\ are\nused to manage additional helper programs and functionalities that support Winlogon. Malicious modifications to these Registry keys may cause Winlogon to\nload and execute malicious DLLs and/or executables.\n","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.004/T1547.004.md"],"logsource":{"product":"windows","category":"ps_script"},"tags":["attack.privilege-escalation","attack.persistence","attack.t1547.004"],"path":"rules/windows/powershell/powershell_script/posh_ps_winlogon_helper_dll.yml","techniques":["T1547.004"],"cves":[]},{"id":"bbf59793-6efb-4fa1-95ca-a7d288e52c88","title":"Winlogon Notify Key Logon Persistence","author":"frack113","status":"test","level":"high","date":"2021-12-30","modified":"2023-08-17","description":"Adversaries may abuse features of Winlogon to execute DLLs and/or executables when a user logs in.\nWinlogon.exe is a Windows component responsible for actions at logon/logoff as well as the secure attention sequence (SAS) triggered by Ctrl-Alt-Delete.\n","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.004/T1547.004.md#atomic-test-3---winlogon-notify-key-logon-persistence---powershell"],"logsource":{"product":"windows","category":"registry_set"},"tags":["attack.privilege-escalation","attack.persistence","attack.t1547.004"],"path":"rules/windows/registry/registry_set/registry_set_winlogon_notify_key.yml","techniques":["T1547.004"],"cves":[]}],"kev_cves":[],"_built":"2026-08-23 05:47 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}