Winlogon Helper DLL Registry Modification via PowerShell

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•17

This rule detects PowerShell script blocks that modify the Windows Registry keys associated with Winlogon helper DLLs. Adversaries can modify these keys to load and execute malicious DLLs or executables when a user logs on, achieving persistence and potentially privilege escalation. The rule specifically looks for the string 'CurrentVersion\Winlogon' in conjunction with PowerShell cmdlets like 'Set-ItemProperty' or 'New-Item', indicating an attempt to alter Winlogon's configuration.