ATT&CK technique
View on MITRE ATT&CK →
T1547.004
Winlogon Helper DLL
PersistencePrivilege Escalation
5 detections found
Detection rules
| Source | Rule | Status | Updated |
|---|---|---|---|
| elastic | Persistence via WMI Standard Registry Provider | production | 2026-09-18 |
| sigma | TanStack Supply-Chain Attack File Creation Indicators - Linux | experimental | 2026-05-12 |
| sigma | Winlogon Notify Key Logon Persistence | test | 2023-08-17 |
| sigma | Winlogon Helper DLL | test | 2022-07-07 |
| sigma | MITRE BZAR Indicators for Persistence | test | 2021-11-27 |