Winlogon Notify Key Logon Persistence

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•19

This rule detects modifications to the Winlogon Notify registry key to establish persistence. Adversaries may abuse Winlogon's features to execute DLLs when a user logs in. The rule specifically looks for changes to the `\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\logon` registry key where the `Details` field indicates a DLL file (`.dll`) is being set.