Unexpected child process of winlogon.exe or userinit.exe

1title: Unexpected child process of winlogon.exe or userinit.exe2id: 54c0b3a4-0ede-4f0e-9f49-2b54abd4a0f33status: experimental4description: |5  Matches the process-creation half of AN1133: a process whose parent is6  winlogon.exe or userinit.exe and which is not one of the handful of binaries7  those two start in an ordinary session. That parentage is the execution8  signature of two of the three subkeys this technique abuses — a Userinit9  value extended with a second path makes winlogon.exe start something that is10  not userinit.exe, and a rewritten Shell value makes userinit.exe start11  something that is not explorer.exe — so the child's identity is the12  discriminator, and the rule is written as an allowlist of the expected13  children. That allowlist (userinit, LogonUI, dwm, fontdrvhost, wlrmdr,14  mpnotify, and rdpclip and AtBroker for remote and accessibility sessions, all15  in System32, plus explorer.exe in the Windows directory) is authored here, not16  taken from MITRE. Each entry is anchored on its full system path rather than17  on its file name alone, because in this technique the adversary owns the path:18  a payload copied to C:\Users\Public\explorer.exe and named in the Shell value19  would be cleared by a bare `\explorer.exe` allowlist, which is the cheapest20  possible evasion of a rule shaped this way. The two parents share one list, so21  a legitimate but unusual crossover such as winlogon.exe starting explorer.exe22  directly is also cleared. Four limits are structural. The registry write that MITRE puts first in this analytic has no23  log source in the brief at all — AN1133 offers only Sysmon EventID 7 and24  EventID 1 — so the change to the Winlogon key itself is not observable here,25  and neither is the TimeWindow knob that would correlate it with the26  execution, which needs a cross-event join lib/sigma does not model. The27  Notify subkey is not covered either: Windows stopped loading Winlogon28  notification package DLLs after XP/2003, and the module-load leg of this29  analytic would in any case be a rule about what winlogon.exe has loaded, for30  which MITRE's BinarySignatureValidation knob is the right test — Sysmon31  EventID 1 carries no signature fields, so that knob cannot be applied in this32  rule. MITRE's ExecutablePathScope knob is left unused rather than narrowed to33  temp or non-System32 paths, because a Userinit payload copied into System3234  is exactly the case the analytic calls out. And an adversary who appends a35  path to Userinit while leaving userinit.exe itself in place still produces a36  match for the added binary, but nothing here says which registry value37  launched it. This rule is written in the Sysmon EventID 1 vocabulary (`Image`,38  `ParentImage`) that AN1133 names; an estate feeding Security 4688 instead39  needs `NewProcessName` and `ParentProcessName` mapped onto those two fields40  first, and 4688 requires the *Audit Process Creation* policy, which is not on41  in a default install. Sysmon itself is not present by default either, and42  with neither in place the rule returns zero rows — which reads as quiet when43  it means blind.44  UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0404, not hand-written and not tested by its author. Any lab result is on this rule's own page.45references:46  - https://attack.mitre.org/techniques/T1547/00447  - https://attack.mitre.org/detectionstrategies/DET040448author: Siemphony pipeline (machine-derived from MITRE ATT&CK v19.2)49date: 2026-08-1650tags:51  - attack.persistence52  - attack.privilege-escalation53  - attack.t1547.00454logsource:55  category: process_creation56  product: windows57detection:58  selection_logon_parent:59    ParentImage|endswith:60      - '\winlogon.exe'61      - '\userinit.exe'62  filter_expected_children:63    Image|endswith:64      - '\Windows\System32\userinit.exe'65      - '\Windows\explorer.exe'66      - '\Windows\System32\LogonUI.exe'67      - '\Windows\System32\dwm.exe'68      - '\Windows\System32\fontdrvhost.exe'69      - '\Windows\System32\wlrmdr.exe'70      - '\Windows\System32\mpnotify.exe'71      - '\Windows\System32\rdpclip.exe'72      - '\Windows\System32\AtBroker.exe'73  filter_logon_scripts:74    # Running logon scripts is part of what userinit.exe is FOR, so a script75    # host under it is expected rather than anomalous. Narrowed to scripts76    # served from NETLOGON or SYSVOL: a Userinit registry hijack — the77    # technique this rule exists to catch — points at a local or user-writable78    # path, so it still fires. Allowlisting the script hosts outright would79    # have blinded the rule to its own technique.80    ParentImage|endswith: '\userinit.exe'81    Image|endswith:82      - '\cmd.exe'83      - '\cscript.exe'84      - '\wscript.exe'85      - '\powershell.exe'86    CommandLine|contains:87      - '\NETLOGON\'88      - '\SYSVOL\'89  condition: selection_logon_parent and not 1 of filter_*90falsepositives:91  - "Legacy per-user logon scripts. A script path set on the account object is run by userinit.exe, so cmd.exe, wscript.exe, cscript.exe or powershell.exe appears as its child once per user per logon. On an estate that still assigns them this is the loudest match by a wide margin, it recurs on every session on every host, and it is the reason this rule is medium rather than high; those four images are deliberately not filtered out, because appending a script host to the Userinit value is the most common shape of the technique itself."92  - "Group Policy logon scripts and the gpscript.exe host that runs them, plus the login-time helpers that endpoint-management, antivirus, backup and licence-metering agents start from the same point in the logon sequence."93  - "Kiosk, VDI and thin-client builds that deliberately replace the Shell value with a single application, a custom launcher or a session broker, so userinit.exe starts that binary instead of explorer.exe on every logon of every session on the pool — a configured, documented change that is indistinguishable at this level of detail from an adversary rewriting the same value."94  - "Third-party shell and session software installed on top of Windows — remote-session agents, alternate desktop shells, profile-management and folder-redirection tools — which register themselves in the Shell or Userinit chain by design and so run under exactly this parentage."95  - "Screen readers, magnifiers and on-screen keyboards launched from the secure desktop, and vendor credential-provider helpers, which winlogon.exe starts by design under names not in the allowlist above."96level: medium