Installer avec Codex ou Claude Copiez ce prompt, collez-le dans Codex, Claude ou un autre assistant, puis laissez-le vérifier la page du skill et l'installer pour vous.
Une commande directe contourne le prompt de vérification. Examinez la source avant de l'exécuter.
{"T1547":"Chain with T1547 for deeper attack path","T1547.001":"Chain with T1547.001 for deeper attack path","T1547.002":"Chain with T1547.002 for deeper attack path"}
T1547.004 Winlogon Helper DLL
Sub-technique of: T1547
High-Level Description
Adversaries may abuse features of Winlogon to execute DLLs and/or executables when a user logs in. Winlogon.exe is a Windows component responsible for actions at logon/logoff as well as the secure attention sequence (SAS) triggered by Ctrl-Alt-Delete. Registry entries in HKLM\Software[\Wow6432Node\]\Microsoft\Windows NT\CurrentVersion\Winlogon</code> and HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon</code> are used to manage additional helper programs and functionalities that support Winlogon.
Malicious modifications to these Registry keys may cause Winlogon to load and execute malicious DLLs and/or executables. Specifically, the following subkeys have been known to be possibly vulnerable to abuse:
Winlogon\Notify - points to notification package DLLs that handle Winlogon events
Winlogon\Userinit - points to userinit.exe, the user initialization program executed when a user logs on
Winlogon\Shell - points to explorer.exe, the system shell executed when a user logs on
Adversaries may take advantage of these features to repeatedly execute malicious code and establish persistence.
Kill Chain Phase
Persistence (TA0003)
Privilege Escalation (TA0004)
Platforms: Windows
What to Check
Identify if Winlogon Helper DLL technique is applicable to target environment
Check Windows systems for indicators of Winlogon Helper DLL
Verify mitigations are bypassed or absent (2 known mitigations)
Atomic Test 3: Winlogon Notify Key Logon Persistence - PowerShell
PowerShell code to set Winlogon Notify key to execute a notification package DLL at logon.
Upon successful execution, PowerShell will modify a registry value to execute atomicNotificationPackage.dll upon logon.
Please note that Winlogon Notifications have been removed as of Windows Vista / Windows Server 2008 and that this test thus only applies to erlier versions of Windows.
If Atomic Red Team tests are not applicable, manually verify the technique by:
Identify Attack Surface: Determine if the target environment is susceptible to Winlogon Helper DLL by examining the target platforms (Windows).
Assess Existing Defenses: Review whether mitigations for T1547.004 are in place. If defenses are absent or misconfigured, this technique may be exploitable.
Execute Test: Use tools and methods described in the MITRE ATT&CK page and external references below.
Remediation Guide
M1038 Execution Prevention
Identify and block potentially malicious software that may be executed through the Winlogon helper process by using application control tools like AppLocker that are capable of auditing and/or blocking unknown DLLs.
M1018 User Account Management
Limit the privileges of user accounts so that only authorized administrators can perform Winlogon helper changes.
Detection
Detect Winlogon Helper DLL Abuse via Registry and Process Artifacts on Windows
