Windows Winlogon Notify Registry Key DLL Persistence (logon)
Alerts on DLL-specified Winlogon Notify logon entries created via registry set events.
- Product
- windows
- Category
- registry_set
- Author
- frack113 (SigmaHQ), DRL 1.1
- Published
- 2021-12-30
- Updated
- 2026-07-30
ATT&CK techniques
Persistence → Priv EscRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags registry changes that set Winlogon Notify logon entries whose Details value ends with a DLL file extension. Abuse of Winlogon Notify can cause code execution during user logon, making it a useful persistence mechanism for attackers. The detection relies on registry set telemetry capturing TargetObject paths under Winlogon\Notify\logon and the stored Details value.
Reporting behind it
- github.comhttps://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.004/T1547.004.md#atomic-test-3---winlogon-notify-key-logon-persistence---powershell
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_winlogon_notify_key.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Winlogon Notify Registry Key DLL Persistence (logon)
id: 2b6f5534-ef2b-4c37-a099-ab0aa4e6820b
status: test
description: This rule flags registry changes that set Winlogon Notify logon entries whose Details value ends with a DLL file extension. Abuse of Winlogon Notify can cause code execution during user logon, making it a useful persistence mechanism for attackers. The detection relies on registry set telemetry capturing TargetObject paths under Winlogon\Notify\logon and the stored Details value.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.004/T1547.004.md#atomic-test-3---winlogon-notify-key-logon-persistence---powershell
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_winlogon_notify_key.yml
author: frack113, Huntrule Team
date: 2021-12-30
modified: 2023-08-17
tags:
- attack.privilege-escalation
- attack.persistence
- attack.t1547.004
logsource:
category: registry_set
product: windows
detection:
selection:
TargetObject|endswith: \SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\logon
Details|endswith: .dll
condition: selection
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: bbf59793-6efb-4fa1-95ca-a7d288e52c88
type: derived