Unexpected child process of winlogon.exe or userinit.exe

Siemphony@siemphonymediumT1547.004unverified

Matches the process-creation half of AN1133: a process whose parent is winlogon.exe or userinit.exe and which is not one of the handful of binaries those two start in an ordinary session. That parentage is the execution signature of two of the three subkeys this technique abuses — a Userinit value extended with a second path makes winlogon.exe start something that is not userinit.exe, and a rewritten Shell value makes userinit.exe start something that is not explorer.exe — so the child's identity is the discriminator, and the rule is written as an allowlist of the expected children. That allowlist (userinit, LogonUI, dwm, fontdrvhost, wlrmdr, mpnotify, and rdpclip and AtBroker for remote and accessibility sessions, all in System32, plus explorer.exe in the Windows directory) is authored here, not taken from MITRE. Each entry is anchored on its full system path rather than on its file name alone, because in this technique the adversary owns the path: a payload copied to C:\Users\Public\explorer.exe and named in the Shell value would be cleared by a bare `\explorer.exe` allowlist, which is the cheapest possible evasion of a rule shaped this way. The two parents share one list, so a legitimate but unusual crossover such as winlogon.exe starting explorer.exe directly is also cleared. Four limits are structural. The registry write that MITRE puts first in this analytic has no log source in the brief at all — AN1133 offers only Sysmon EventID 7 and EventID 1 — so the change to the Winlogon key itself is not observable here, and neither is the TimeWindow knob that would correlate it with the execution, which needs a cross-event join lib/sigma does not model. The Notify subkey is not covered either: Windows stopped loading Winlogon notification package DLLs after XP/2003, and the module-load leg of this analytic would in any case be a rule about what winlogon.exe has loaded, for which MITRE's BinarySignatureValidation knob is the right test — Sysmon EventID 1 carries no signature fields, so that knob cannot be applied in this rule. MITRE's ExecutablePathScope knob is left unused rather than narrowed to temp or non-System32 paths, because a Userinit payload copied into System32 is exactly the case the analytic calls out. And an adversary who appends a path to Userinit while leaving userinit.exe itself in place still produces a match for the added binary, but nothing here says which registry value launched it. This rule is written in the Sysmon EventID 1 vocabulary (`Image`, `ParentImage`) that AN1133 names; an estate feeding Security 4688 instead needs `NewProcessName` and `ParentProcessName` mapped onto those two fields first, and 4688 requires the *Audit Process Creation* policy, which is not on in a default install. Sysmon itself is not present by default either, and with neither in place the rule returns zero rows — which reads as quiet when it means blind. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0404, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where ((InitiatingProcessFolderPath endswith "\\winlogon.exe" or InitiatingProcessFolderPath endswith "\\userinit.exe") and not (((FolderPath endswith "\\Windows\\System32\\userinit.exe" or FolderPath endswith "\\Windows\\explorer.exe" or FolderPath endswith "\\Windows\\System32\\LogonUI.exe" or FolderPath endswith "\\Windows\\System32\\dwm.exe" or FolderPath endswith "\\Windows\\System32\\fontdrvhost.exe" or FolderPath endswith "\\Windows\\System32\\wlrmdr.exe" or FolderPath endswith "\\Windows\\System32\\mpnotify.exe" or FolderPath endswith "\\Windows\\System32\\rdpclip.exe" or FolderPath endswith "\\Windows\\System32\\AtBroker.exe") or (InitiatingProcessFolderPath endswith "\\userinit.exe" and (FolderPath endswith "\\cmd.exe" or FolderPath endswith "\\cscript.exe" or FolderPath endswith "\\wscript.exe" or FolderPath endswith "\\powershell.exe") and (ProcessCommandLine contains "\\NETLOGON\\" or ProcessCommandLine contains "\\SYSVOL\\")))))

Splunk · SPL

Run this as a search.

index=* ((ParentImage="*\\winlogon.exe" OR ParentImage="*\\userinit.exe") AND NOT (((Image="*\\Windows\\System32\\userinit.exe" OR Image="*\\Windows\\explorer.exe" OR Image="*\\Windows\\System32\\LogonUI.exe" OR Image="*\\Windows\\System32\\dwm.exe" OR Image="*\\Windows\\System32\\fontdrvhost.exe" OR Image="*\\Windows\\System32\\wlrmdr.exe" OR Image="*\\Windows\\System32\\mpnotify.exe" OR Image="*\\Windows\\System32\\rdpclip.exe" OR Image="*\\Windows\\System32\\AtBroker.exe") OR (ParentImage="*\\userinit.exe" AND (Image="*\\cmd.exe" OR Image="*\\cscript.exe" OR Image="*\\wscript.exe" OR Image="*\\powershell.exe") AND (CommandLine="*\\NETLOGON\\*" OR CommandLine="*\\SYSVOL\\*")))))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE ((TO_LOWER(process.parent.executable) LIKE "*\\\\winlogon.exe" OR TO_LOWER(process.parent.executable) LIKE "*\\\\userinit.exe") AND NOT (((TO_LOWER(process.executable) LIKE "*\\\\windows\\\\system32\\\\userinit.exe" OR TO_LOWER(process.executable) LIKE "*\\\\windows\\\\explorer.exe" OR TO_LOWER(process.executable) LIKE "*\\\\windows\\\\system32\\\\logonui.exe" OR TO_LOWER(process.executable) LIKE "*\\\\windows\\\\system32\\\\dwm.exe" OR TO_LOWER(process.executable) LIKE "*\\\\windows\\\\system32\\\\fontdrvhost.exe" OR TO_LOWER(process.executable) LIKE "*\\\\windows\\\\system32\\\\wlrmdr.exe" OR TO_LOWER(process.executable) LIKE "*\\\\windows\\\\system32\\\\mpnotify.exe" OR TO_LOWER(process.executable) LIKE "*\\\\windows\\\\system32\\\\rdpclip.exe" OR TO_LOWER(process.executable) LIKE "*\\\\windows\\\\system32\\\\atbroker.exe") OR (TO_LOWER(process.parent.executable) LIKE "*\\\\userinit.exe" AND (TO_LOWER(process.executable) LIKE "*\\\\cmd.exe" OR TO_LOWER(process.executable) LIKE "*\\\\cscript.exe" OR TO_LOWER(process.executable) LIKE "*\\\\wscript.exe" OR TO_LOWER(process.executable) LIKE "*\\\\powershell.exe") AND (TO_LOWER(process.command_line) LIKE "*\\\\netlogon\\\\*" OR TO_LOWER(process.command_line) LIKE "*\\\\sysvol\\\\*")))))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <!-- 3 rules: the Sigma condition ORs across different fields,       which one rule cannot express. Any one matching is a hit. -->  <rule id="100000" level="7">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="ParentImage" type="pcre2">(?i)(\\winlogon\.exe$|\\userinit\.exe$)</field>    <field name="Image" negate="yes" type="pcre2">(?i)(\\Windows\\System32\\userinit\.exe$|\\Windows\\explorer\.exe$|\\Windows\\System32\\LogonUI\.exe$|\\Windows\\System32\\dwm\.exe$|\\Windows\\System32\\fontdrvhost\.exe$|\\Windows\\System32\\wlrmdr\.exe$|\\Windows\\System32\\mpnotify\.exe$|\\Windows\\System32\\rdpclip\.exe$|\\Windows\\System32\\AtBroker\.exe$)</field>    <field name="ParentImage" negate="yes" type="pcre2">(?i)\\userinit\.exe$</field>    <description>Unexpected child process of winlogon.exe or userinit.exe (1/3)</description>    <mitre>      <id>T1547.004</id>    </mitre>  </rule>   <rule id="100001" level="7">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="ParentImage" type="pcre2">(?i)(\\winlogon\.exe$|\\userinit\.exe$)</field>    <field name="Image" negate="yes" type="pcre2">(?i)(\\Windows\\System32\\userinit\.exe$|\\Windows\\explorer\.exe$|\\Windows\\System32\\LogonUI\.exe$|\\Windows\\System32\\dwm\.exe$|\\Windows\\System32\\fontdrvhost\.exe$|\\Windows\\System32\\wlrmdr\.exe$|\\Windows\\System32\\mpnotify\.exe$|\\Windows\\System32\\rdpclip\.exe$|\\Windows\\System32\\AtBroker\.exe$)</field>    <field name="Image" negate="yes" type="pcre2">(?i)(\\cmd\.exe$|\\cscript\.exe$|\\wscript\.exe$|\\powershell\.exe$)</field>    <description>Unexpected child process of winlogon.exe or userinit.exe (2/3)</description>    <mitre>      <id>T1547.004</id>    </mitre>  </rule>   <rule id="100002" level="7">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="ParentImage" type="pcre2">(?i)(\\winlogon\.exe$|\\userinit\.exe$)</field>    <field name="Image" negate="yes" type="pcre2">(?i)(\\Windows\\System32\\userinit\.exe$|\\Windows\\explorer\.exe$|\\Windows\\System32\\LogonUI\.exe$|\\Windows\\System32\\dwm\.exe$|\\Windows\\System32\\fontdrvhost\.exe$|\\Windows\\System32\\wlrmdr\.exe$|\\Windows\\System32\\mpnotify\.exe$|\\Windows\\System32\\rdpclip\.exe$|\\Windows\\System32\\AtBroker\.exe$)</field>    <field name="CommandLine" negate="yes" type="pcre2">(?i)(\\NETLOGON\\|\\SYSVOL\\)</field>    <description>Unexpected child process of winlogon.exe or userinit.exe (3/3)</description>    <mitre>      <id>T1547.004</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / windows
Level: medium
Category: registry_persistence
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: 54c0b3a4-0ede-4f0e-9f49-2b54abd4a0f3

ATT&CKT1547.004

T1547.004Winlogon Helper DLL

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessonregistry persistence

registry persistenceAI draft — unreviewed

01 · What this rule detects

AN1133 describes a registry write to HKLM\...\Winlogon followed by an odd process starting under the logon chain. This rule implements only the second half: a process whose parent is winlogon.exe or userinit.exe and which is not one of the binaries those two normally start. Say the consequence plainly. A hit is unexpected parentage, not a proven registry change. The same parentage is produced by an accessibility-feature debugger (T1546.008) and by ordinary logon scripts (T1037.001), and the event carries nothing that separates them. Confirming T1547.004 means reading the Winlogon key, which this rule cannot see.

02 · Telemetry you need

category: process_creation / product: windows, copied verbatim from AN1133. The rule is written in the Sysmon EventID 1 vocabulary (Image, ParentImage). An estate on Security 4688 must map NewProcessName and ParentProcessName onto those fields first, and 4688 needs the Audit Process Creation policy, which is off by default. Sysmon is not installed by default either. With neither in place the rule returns zero rows, and zero rows reads as quiet when it means blind.
AN1133's other log source, Sysmon EventID 7, is unused, so the Notify subkey — the DLL half the technique is named after — is not covered here at all.

03 · How the logic works

Two blocks. selection_logon_parent matches ParentImage|endswith against \winlogon.exe or \userinit.exe. filter_expected_children is an allowlist of nine images, and the condition is selection_logon_parent and not filter_expected_children — one field negated, which keeps the rule renderable in all four backends. The allowlist contents are authored here, not MITRE's: userinit, LogonUI, dwm, fontdrvhost, wlrmdr, mpnotify, plus rdpclip and AtBroker for remote and accessibility sessions, and explorer.exe. What matters is that each entry is anchored on a full system path (\Windows\System32\userinit.exe, \Windows\explorer.exe) rather than a bare filename. In this technique the adversary chooses the path written into the Shell or Userinit value, so a basename allowlist is cleared by copying the payload to C:\Users\Public\explorer.exe — a one-command evasion. That fix was made during review and is the single most important thing in the rule. Both parents share one allowlist, so a legitimate crossover such as winlogon.exe launching explorer.exe directly is also cleared. MITRE's TimeWindow knob (correlate the registry write with the execution) needs a cross-event join lib/sigma does not model. BinarySignatureValidation has no field on EventID 1. ExecutablePathScope is deliberately left unused rather than narrowed to temp paths, because a payload dropped into System32 is exactly the case the analytic calls out.

04 · Common false positives

Loudest by a wide margin: legacy per-user logon scripts. A script path on the account object makes userinit.exe start cmd.exe, wscript.exe or powershell.exe once per user per logon. Those four are deliberately not filtered, because appending a script host to the Userinit value is the technique itself. Behind them sit GPO scripts via gpscript.exe, endpoint-management and antivirus logon helpers, and — structurally worst — kiosk and VDI builds that replace the Shell value with a custom launcher on every session in the pool, a documented change indistinguishable from the abuse here. That first entry is why the rule is medium, not high.

05 · Detection maturity

tier_1: , and it stays there until it has been run against real data. It is derived from a MITRE scaffold that contains no query logic and has never been executed against a log line.
tier_2: run read-only for a fortnight, rank hits by `Image`, and turn the top of that list into the allowlist extension.
tier_3: ** pair it with registry telemetry on the Winlogon key so an alert means a persistence write, not a parentage anomaly.

Tuning & false positivesexperimental · 5 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Baseline your logon chain, then extend the allowlist with the agent helpers
Do not blanket-exclude the script hosts. Narrow on the script path in
Build the missing legs as companions: an image_load rule for modules
Add attack.t1546.008 and attack.t1037.001 tags so the overlap is honest

Declared by the author

Legacy per-user logon scripts. A script path set on the account object is run by userinit.exe, so cmd.exe, wscript.exe, cscript.exe or powershell.exe appears as its child once per user per logon. On an estate that still assigns them this is the loudest match by a wide margin, it recurs on every session on every host, and it is the reason this rule is medium rather than high; those four images are deliberately not filtered out, because appending a script host to the Userinit value is the most common shape of the technique itself.
Group Policy logon scripts and the gpscript.exe host that runs them, plus the login-time helpers that endpoint-management, antivirus, backup and licence-metering agents start from the same point in the logon sequence.
Kiosk, VDI and thin-client builds that deliberately replace the Shell value with a single application, a custom launcher or a session broker, so userinit.exe starts that binary instead of explorer.exe on every logon of every session on the pool — a configured, documented change that is indistinguishable at this level of detail from an adversary rewriting the same value.
Third-party shell and session software installed on top of Windows — remote-session agents, alternate desktop shells, profile-management and folder-redirection tools — which register themselves in the Shell or Userinit chain by design and so run under exactly this parentage.
Screen readers, magnifiers and on-screen keyboards launched from the secure desktop, and vendor credential-provider helpers, which winlogon.exe starts by design under names not in the allowlist above.

Noise check0 of 30 fired

Fires on none of the 30 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 30 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1547.004, evaluated against their process_creation events.

Share this rule

/u/siemphony/54c0b3a4-0ede-4f0e-9f49-2b54abd4a0f3

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Unexpected child process of winlogon.exe or userinit.exe

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it