t1547-004-winlogon-helper-dll

name	T1547.004_winlogon-helper-dll
description	Adversaries may abuse features of Winlogon to execute DLLs and/or executables when a user logs in.
category	configuration
version	18.1
author	cyberstrike-official
tags	["mitre-attack","enterprise","t1547.004","persistence","privilege-escalation","windows","sub-technique"]
technique_id	T1547.004
tactic	persistence
all_tactics	["persistence","privilege-escalation"]
platforms	["Windows"]
mitre_url	https://attack.mitre.org/techniques/T1547/004
tech_stack	["windows"]
cwe_ids	["CWE-276"]
chains_with	["T1547","T1547.001","T1547.002","T1547.003","T1547.005","T1547.006","T1547.007","T1547.008","T1547.009","T1547.010","T1547.012","T1547.013","T1547.014","T1547.015"]
prerequisites	["T1547"]
severity_boost	{"T1547":"Chain with T1547 for deeper attack path","T1547.001":"Chain with T1547.001 for deeper attack path","T1547.002":"Chain with T1547.002 for deeper attack path"}

T1547.004 Winlogon Helper DLL

Sub-technique of: T1547

High-Level Description

Adversaries may abuse features of Winlogon to execute DLLs and/or executables when a user logs in. Winlogon.exe is a Windows component responsible for actions at logon/logoff as well as the secure attention sequence (SAS) triggered by Ctrl-Alt-Delete. Registry entries in HKLM\Software[\Wow6432Node\]\Microsoft\Windows NT\CurrentVersion\Winlogon</code> and HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon</code> are used to manage additional helper programs and functionalities that support Winlogon.

Malicious modifications to these Registry keys may cause Winlogon to load and execute malicious DLLs and/or executables. Specifically, the following subkeys have been known to be possibly vulnerable to abuse:

• Winlogon\Notify - points to notification package DLLs that handle Winlogon events
• Winlogon\Userinit - points to userinit.exe, the user initialization program executed when a user logs on
• Winlogon\Shell - points to explorer.exe, the system shell executed when a user logs on

Adversaries may take advantage of these features to repeatedly execute malicious code and establish persistence.

Kill Chain Phase

• Persistence (TA0003)
• Privilege Escalation (TA0004)

Platforms: Windows

What to Check

• Identify if Winlogon Helper DLL technique is applicable to target environment
• Check Windows systems for indicators of Winlogon Helper DLL
• Verify mitigations are bypassed or absent (2 known mitigations)
• Assess detection coverage (1 detection strategies)

How to Test

Atomic Red Team Tests

The following tests are from Atomic Red Team and provide actionable ways to test this technique:

Atomic Test 1: Winlogon Shell Key Persistence - PowerShell

PowerShell code to set Winlogon shell key to execute a binary at logon along with explorer.exe.

Upon successful execution, PowerShell will modify a registry value to execute cmd.exe upon logon/logoff.

Supported Platforms: windows

Set-ItemProperty "HKCU:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\" "Shell" "explorer.exe, #{binary_to_execute}" -Force