CircleCI Atomic Red Team doc generator
86 lines
3.4 KiB
Markdown
86 lines
3.4 KiB
Markdown
# T1004 - Winlogon Helper DLL
|
|
## [Description from ATT&CK](https://attack.mitre.org/wiki/Technique/T1004)
|
|
<blockquote>Winlogon.exe is a Windows component responsible for actions at logon/logoff as well as the secure attention sequence (SAS) triggered by Ctrl-Alt-Delete. Registry entries in <code>HKLM\Software\[Wow6432Node\]Microsoft\Windows NT\CurrentVersion\Winlogon\</code> and <code>HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\</code> are used to manage additional helper programs and functionalities that support Winlogon. (Citation: Cylance Reg Persistence Sept 2013)
|
|
|
|
Malicious modifications to these Registry keys may cause Winlogon to load and execute malicious DLLs and/or executables. Specifically, the following subkeys have been known to be possibly vulnerable to abuse: (Citation: Cylance Reg Persistence Sept 2013)
|
|
|
|
* Winlogon\Notify - points to notification package DLLs that handle Winlogon events
|
|
* Winlogon\Userinit - points to userinit.exe, the user initialization program executed when a user logs on
|
|
* Winlogon\Shell - points to explorer.exe, the system shell executed when a user logs on
|
|
|
|
Adversaries may take advantage of these features to repeatedly execute malicious code and establish Persistence.</blockquote>
|
|
|
|
## Atomic Tests
|
|
|
|
- [Atomic Test #1 - Winlogon Shell Key Persistence - PowerShell](#atomic-test-1---winlogon-shell-key-persistence---powershell)
|
|
|
|
- [Atomic Test #2 - Winlogon Userinit Key Persistence - PowerShell](#atomic-test-2---winlogon-userinit-key-persistence---powershell)
|
|
|
|
- [Atomic Test #3 - Winlogon Notify Key Logon Persistence - PowerShell](#atomic-test-3---winlogon-notify-key-logon-persistence---powershell)
|
|
|
|
|
|
<br/>
|
|
|
|
## Atomic Test #1 - Winlogon Shell Key Persistence - PowerShell
|
|
PowerShell code to set Winlogon shell key to execute a binary at logon along with explorer.exe.
|
|
|
|
**Supported Platforms:** Windows
|
|
|
|
|
|
#### Inputs
|
|
| Name | Description | Type | Default Value |
|
|
|------|-------------|------|---------------|
|
|
| binary_to_execute | Path of binary to execute | Path | C:\Windows\System32\cmd.exe|
|
|
|
|
#### Run it with `powershell`!
|
|
```
|
|
Set-ItemProperty "HKCU:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\" "Shell" "explorer.exe, #{binary_to_execute}" -Force
|
|
```
|
|
|
|
|
|
|
|
<br/>
|
|
<br/>
|
|
|
|
## Atomic Test #2 - Winlogon Userinit Key Persistence - PowerShell
|
|
PowerShell code to set Winlogon userinit key to execute a binary at logon along with userinit.exe.
|
|
|
|
**Supported Platforms:** Windows
|
|
|
|
|
|
#### Inputs
|
|
| Name | Description | Type | Default Value |
|
|
|------|-------------|------|---------------|
|
|
| binary_to_execute | Path of binary to execute | Path | C:\Windows\System32\cmd.exe|
|
|
|
|
#### Run it with `powershell`!
|
|
```
|
|
Set-ItemProperty "HKCU:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\" "Userinit" "Userinit.exe, #{binary_to_execute}" -Force
|
|
```
|
|
|
|
|
|
|
|
<br/>
|
|
<br/>
|
|
|
|
## Atomic Test #3 - Winlogon Notify Key Logon Persistence - PowerShell
|
|
PowerShell code to set Winlogon Notify key to execute a notification package DLL at logon.
|
|
|
|
**Supported Platforms:** Windows
|
|
|
|
|
|
#### Inputs
|
|
| Name | Description | Type | Default Value |
|
|
|------|-------------|------|---------------|
|
|
| binary_to_execute | Path of notification package to execute | Path | C:\Windows\Temp\atomicNotificationPackage.dll|
|
|
|
|
#### Run it with `powershell`!
|
|
```
|
|
New-Item "HKCU:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify" -Force
|
|
Set-ItemProperty "HKCU:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify" "logon" "#{binary_to_execute}" -Force
|
|
```
|
|
|
|
|
|
|
|
<br/>
|