PowerShell Script Block Monitoring for Winlogon Registry Helper Modification on Windows

title: PowerShell Script Block Monitoring for Winlogon Registry Helper Modification on Windows
id: 19a191af-1d44-487a-b0ea-68606438497b
status: test
description: This rule flags PowerShell script blocks that reference the Winlogon registry paths under HKLM\Software[Wow6432Node]\Microsoft\Windows NT\CurrentVersion\Winlogon and HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon while using commands like Set-ItemProperty or New-Item. Attackers can leverage these Winlogon helper locations to alter what Winlogon loads or executes, enabling persistence or privilege escalation. The detection relies on Script Block Logging telemetry containing the relevant registry path text and the specific PowerShell property/item modification commands.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.004/T1547.004.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_winlogon_helper_dll.yml
author: Timur Zinniatullin, oscd.community, Huntrule Team
date: 2019-10-21
modified: 2022-07-07
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.t1547.004
logsource:
  product: windows
  category: ps_script
  definition: "Requirements: Script Block Logging must be enabled"
detection:
  selection:
    ScriptBlockText|contains: CurrentVersion\Winlogon
  selection2:
    ScriptBlockText|contains:
      - Set-ItemProperty
      - New-Item
  condition: all of selection*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 851c506b-6b7c-4ce2-8802-c703009d03c0
    type: derived