T1547.004PersistencePrivilege Escalation
Winlogon Helper DLL
Adversaries may abuse features of Winlogon to execute DLLs and/or executables when a user logs in. Winlogon.exe is a Windows component responsible for actions at logon/logoff as well as the secure attention sequence (SAS) triggered by Ctrl-Alt-Delete. Registry entries in HKLM\Software[\\Wow6432Node\\]\Microsoft\Windows NT\CurrentVersion\Winlogon\ and HKCU\Software\Microsoft\Windows…
CVEs0
In CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it.0
Reports0
Detections
4 Sigma rules tagged T1547.004Winlogon Helper DLLT1547.0044 general rules
- Winlogon Notify Key Logon Persistencehightest
- MITRE BZAR Indicators for Persistencemediumtest
- Winlogon Helper DLLmediumtest
- TanStack Supply-Chain Attack File Creation Indicators - Linuxmediumexperimental
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
CVEs linked to Winlogon Helper DLL
0 CVEs, by priority. Each link shows its badge.No CVEs are linked to this technique yet.