Abuse of Winlogon Notify Registry Keys for Persistence

Adversaries may abuse the Winlogon Notify feature in Windows to maintain persistence and potentially elevate privileges. Winlogon.exe is a core Windows component responsible for handling user logon and logoff sequences, as well as the Secure Attention Sequence (SAS) triggered by the Ctrl-Alt-Delete key combination. By registering a malicious DLL under the HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify registry path, an attacker ensures that their code is loaded and executed by the Winlogon process whenever a user logs in. This technique is a well-documented method for achieving persistent execution that is transparent to the user and resilient across reboots. Defenders should monitor for unexpected registry modifications within the Notify subtree that point to suspicious or non-standard DLL locations.

Impact

Successful exploitation of this technique allows an attacker to maintain a persistent foothold on an affected system with the privileges of the Winlogon process (SYSTEM), potentially leading to complete system compromise, credential theft, or the deployment of secondary payloads in the context of every user session.

Recommendation

Detection engineering teams should monitor registry modifications targeting the Winlogon Notify keys to detect unauthorized persistence mechanisms.

• Deploy the provided Sigma rule to detect registry set events targeting the Winlogon\Notify subkeys.
• Baseline existing legitimate DLL entries in the Winlogon Notify registry hive to reduce false positives during initial implementation.
• Implement monitoring for unsigned or suspicious DLLs residing in non-standard system directories that appear in the Winlogon registry configurations.