Winlogon launch values or SafeDllSearchMode rewritten

1title: Winlogon launch values or SafeDllSearchMode rewritten2id: 420d5e96-ddb2-4149-a25b-701e5aaa6b273status: experimental4description: |5  Matches a Sysmon EventID 13 registry write to the two places AN0781 names as6  its own examples of this technique: the Winlogon launch values (Userinit,7  Shell and the Notify subkey) and the SafeDllSearchMode value under Session8  Manager. On `registry_set` the value name is appended to `TargetObject` and9  the written data lands in `Details`, so the Winlogon leg gates on the key10  path and then drops the two strings Windows itself stores there —11  `C:\Windows\system32\userinit.exe,` and `explorer.exe` — through a `Details`12  filter, since those keys are written during ordinary setup and the default13  data is what makes a benign write recognisable. Anything else survives the14  filter, including a second path appended after the comma, which is the shape15  of the technique. The SafeDllSearchMode leg carries no such filter: any write16  to that value is worth a look, and the enable-versus-disable distinction17  would need a `Details` match on Sysmon's DWORD rendering, left off18  deliberately rather than risk a selector that never fires. The Run keys the19  analytic also mentions are excluded because the sibling T1547.001 rule20  already covers them with a payload gate this could not improve on; the21  Winlogon registry write itself is covered nowhere else, since the T1547.00422  rule watches the resulting child process instead of the write. The key list23  is MITRE's `RegistryKeyPathPatterns` knob populated here with the analytic's24  own examples; the `ParentProcessAllowList`, `SignatureCheck` and `TimeWindow`25  knobs are unused, because `registry_set` carries the writing process as26  `Image` but no parent and no signature fields, and correlating the write with27  a later execution needs a cross-event join lib/sigma does not model. Sysmon28  is not installed by default and most shipped Sysmon configurations filter29  EventID 13 down to an allowlist of keys, so both subtrees have to be in that30  allowlist or the rule returns zero rows — which reads as quiet when it means31  blind.32  UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0280, not hand-written and not tested by its author. Any lab result is on this rule's own page.33references:34  - https://attack.mitre.org/techniques/T111235  - https://attack.mitre.org/detectionstrategies/DET028036author: Siemphony pipeline (machine-derived from MITRE ATT&CK v19.2)37date: 2026-08-1638tags:39  - attack.defense-evasion40  - attack.persistence41  - attack.t111242logsource:43  category: registry_set44  product: windows45detection:46  selection_winlogon:47    TargetObject|contains:48      - '\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit'49      - '\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell'50      - '\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\'51  filter_default_values:52    Details:53      - 'C:\Windows\system32\userinit.exe,'54      - 'explorer.exe'55  selection_safedll:56    TargetObject|endswith: '\Control\Session Manager\SafeDllSearchMode'57  condition: (selection_winlogon and not filter_default_values) or selection_safedll58falsepositives:59  - "Hardening and compliance tooling writing SafeDllSearchMode explicitly to assert its enabled state. CIS and STIG remediation scripts set the value to 1 rather than trusting the default, so a scheduled compliance run matches the second leg on every host it touches, which makes it the highest-volume source of matches on a managed estate."60  - "Operating-system servicing and imaging. A feature update, an in-place upgrade or a sysprep pass rewrites the Winlogon Userinit and Shell values during setup, and any spelling of the default data other than the two strings in the filter — a Userinit value written without its trailing comma, or with a different system path — is not cleared by it."61  - "Remote-desktop, kiosk and VDI products that replace the Winlogon Shell value with their own session host so the user lands in a published application instead of Explorer. This is a supported configuration and on an estate that runs one it is the most common non-default value in that key."62  - "Credential providers, smart-card middleware and endpoint agents that register a Winlogon Notify subkey when they install, which produces a burst of writes across the fleet during a deployment window."63level: medium