PowerShell ScriptBlock Winlogon Registry Modification via CurrentVersion\Winlogon

Detects PowerShell script blocks that modify Winlogon helper registry keys via Set-ItemProperty or New-Item on Windows.

FreeReviewedSigma · Medium · v2

Product: windows
Category: ps_script
Author: Timur Zinniatullin, oscd.community (SigmaHQ), DRL 1.1
Published: 2019-10-21
Updated: 2026-07-31

ATT&CK techniques

Persistence → Priv Esc

Recon
Resource Dev
Initial Access
Execution
Persistence
- T1547.004Winlogon Helper DLL
Priv Esc
- T1547.004Winlogon Helper DLL
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies PowerShell activity where script block text references the Winlogon registry path under CurrentVersion\Winlogon. It also requires the script to include common registry modification commands (Set-ItemProperty and New-Item) and the creation of new items (New-Item). Because Winlogon helper settings can influence what programs Winlogon loads, malicious use of these paths may enable persistence or privilege impact. The detection relies on PowerShell Script Block Logging telemetry capturing the script block content.

Reporting behind it

Related detections7 linkedT1547.004 — drag to rearrange

Malicious Winlogon Shell or Userinit Persistence Modification (via registry_set)

Suspicious Command Prompt Spawned by Winlogon

Suspicious Winlogon Loading Keyboard Layout DLL kbdus1.dll

Malicious Winlogon Shell Persistence Modification (via registry_set)

Linux File Creation Indicators for TanStack Runner and Persistence Components

Windows Winlogon Notify Registry Key DLL Persistence (logon)

Zeek DCE-RPC spoolss and IRemoteWinspool Calls Indicating Windows Print-Related Persistence

PowerShell ScriptBlock Winlogon Registry Modification via CurrentVersion\Winlogon

Pivot detection · T1547.004 · 7 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

powershell-script-block-monitoring-for-winlogon-registry-helper-modification-on--851c506b

title: PowerShell ScriptBlock Winlogon Registry Modification via CurrentVersion\Winlogon
id: 19a191af-1d44-487a-b0ea-68606438497b
status: test
description: This rule identifies PowerShell activity where script block text references the Winlogon registry path under CurrentVersion\Winlogon. It also requires the script to include common registry modification commands (Set-ItemProperty and New-Item) and the creation of new items (New-Item). Because Winlogon helper settings can influence what programs Winlogon loads, malicious use of these paths may enable persistence or privilege impact. The detection relies on PowerShell Script Block Logging telemetry capturing the script block content.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.004/T1547.004.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_winlogon_helper_dll.yml
author: Timur Zinniatullin, oscd.community, Huntrule Team
date: 2019-10-21
modified: 2022-07-07
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.t1547.004
logsource:
  product: windows
  category: ps_script
  definition: "Requirements: Script Block Logging must be enabled"
detection:
  selection:
    ScriptBlockText|contains: CurrentVersion\Winlogon
  selection2:
    ScriptBlockText|contains:
      - Set-ItemProperty
      - New-Item
  condition: all of selection*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 851c506b-6b7c-4ce2-8802-c703009d03c0
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL