Loading story…
Attackers can maintain persistence on Windows by abusing Winlogon autostart mechanisms, including modification of registry values such as HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell and Userinit, as well as use of the Winlogon Helper DLL technique tracked by MITRE ATT&CK as T1547.004. By altering these settings, a malicious executable or DLL can be launched automatically during user logon, giving malware a reliable way to survive reboots and regain execution.
Public technical material showed a C++ proof of concept that rewrites Winlogon registry keys to start a test payload at logon and noted that older Windows versions may also expose persistence through the Winlogon\Notify key. The technique requires elevated privileges, but it has been associated with real-world malware activity, including Turla, Gazer, and Bazaar. Defenders are advised to restrict local administrator access and monitor Winlogon-related autorun entries for unauthorized changes, including with tools such as Sysinternals Autoruns.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
A technical article demonstrated Windows persistence by modifying Winlogon registry keys such as Shell and Userinit so a test payload would execute at user logon. The walkthrough included proof-of-concept C++ code, validation steps, cleanup guidance, and noted the technique's use by Turla, Gazer, and Bazaar.
MITRE ATT&CK published the Enterprise sub-technique 'Boot or Logon Autostart Execution: Winlogon Helper DLL' as T1547.004, documenting abuse of Winlogon-related mechanisms for persistence.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
cocomelonc.github.io
Open sourceattack.mitre.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A series of public proof-of-concept posts detailed how attackers can establish persistence on Windows by abusing multiple native mechanisms, including `AppInit_DLLs`, COM hijacking, Windows services, logon scripts, file-association changes, uninstall handlers, Event Viewer help links, shell `CLSID` command handlers, and Accessibility Features such as Sticky Keys. The demonstrations showed malware-like code modifying keys under `HKLM` and `HKCU` to force execution at boot, logon, application launch, or user interaction, with several techniques requiring administrator privileges while others worked in the current user context. The examples included replacing `.txt` open commands, setting `HKCU\Environment\UserInitMprLogonScript`, creating malicious `InprocServer32` registrations for COM objects, altering `UninstallString` values for installed software, redirecting Event Viewer online help to a local executable, and using either Image File Execution Options or symbolic links to hijack `sethc.exe`. The posts also tied several methods to known threat activity, citing groups and malware such as **APT28**, **APT39**, **Turla**, **Kimsuky**, **APT3**, **APT29**, **APT32**, **APT38**, **APT41**, Ramsay, Attor, Zebrocy, Mosquito, and SILENTTRINITY as examples of similar persistence tradecraft seen in the wild.
Aug 14, 2026
Security researchers described a Windows persistence technique that abuses **Mandatory User Profiles** by planting a modified `NTUSER.MAN` registry hive in a user profile directory, causing attacker-controlled settings to load into `HKEY_CURRENT_USER` at logon. Because the hive is prepared offline and then consumed by the normal profile-loading process, the method can evade security products that primarily monitor registry API activity such as `RegCreateKey` and `RegSetValue`. The approach is particularly relevant to kiosks, shared workstations, and other environments where mandatory profiles may already be in use. The reporting highlighted proof-of-concept tooling including **Praetorian Swarmer** and **HiveSwarming**, which can transform exported `HKCU` data into an `NTUSER.MAN` hive and add startup persistence such as a **Run** key. Defenders were advised to monitor creation of `NTUSER.MAN` files in user profile paths, correlate those events with **Microsoft-Windows-User Profile Service Operational** events `5` and `67`, and watch for suspicious `Offreg.dll` loads. Researchers characterized the technique as uncommon but stealthy, expanding attention on Windows registry attack surface and profile-handling mechanisms as a path for persistence.
Aug 14, 2026
Researchers published proof-of-concept Windows persistence techniques that abuse registry-controlled DLL load paths to force trusted processes to load attacker-controlled libraries. One method modifies `HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries64\000000000007` by changing the `LibraryPath` value, causing socket-using applications such as **Microsoft Edge** to load a malicious DLL when launched; the demonstration on Windows 11 x64 required administrative privileges and used a benign message-box payload. A related earlier technique targeted `HKLM\Software\Microsoft\Cryptography\Offload`, where setting `ExpoOffload` to a rogue DLL reportedly caused cryptography-related processes including `svchost.exe` to load it.
Aug 15, 2026