CAPEC Definitions
CAPEC Definitions / CAPEC-579
CAPEC-579: Replace Winlogon Helper DLL
Winlogon is a part of Windows that performs logon actions. In Windows systems prior to Windows Vista, a registry key can be modified that causes Winlogon to load a DLL on startup. Adversaries may take advantage of this feature to load adversarial code at startup.
Severity:
Possibility:
Extended Description
No Extended Description.
Mitigations
Changes to registry entries in HKLMSoftwareMicrosoftWindows NTWinlogonNotify that do not correlate with known software, patch cycles, etc are suspicious. New DLLs written to System32 which do not correlate with known good software or patching may be suspicious.
Relationships with other CAPECs
CAPEC-542: Targeted Malware
Prerequisites
No prerequisites found.
Related Weaknesses
CWE-15: External Control of System or Configuration Setting
