CAPEC-579 Detail

CAPEC-579

Name

Replace Winlogon Helper DLL

Status

Draft

Published

2015-11-09
00h00 +00:00

Modified

2023-01-24
00h00 +00:00

Official links

CAPEC Mitre.org

Alerte pour un CAPEC

Stay informed of any changes for a specific CAPEC.

Notifications manage

List of Notifications

Alerte pour un CAPEC

Stay informed of any changes for a specific CAPEC.

Parameters

You can specify a title that will be retrieved in the alerts that will be sent out.

Specify the CAPEC ID you wish to monitor.

Planning

Month

Next run calculation

Day

Weekday

Hour

Minute

Creation date

Last execution

Next execution

Functionality requiring a connection

This feature, which allows you to receive alerts, is only active when you are logged into your account.

Descriptions CAPEC

Winlogon is a part of Windows that performs logon actions. In Windows systems prior to Windows Vista, a registry key can be modified that causes Winlogon to load a DLL on startup. Adversaries may take advantage of this feature to load adversarial code at startup.

Informations CAPEC

Mitigations

Changes to registry entries in "HKLM\Software\Microsoft\Windows NT\Winlogon\Notify" that do not correlate with known software, patch cycles, etc are suspicious. New DLLs written to System32 which do not correlate with known good software or patching may be suspicious.

Related Weaknesses

CWE-ID	Weakness Name
CWE-15	External Control of System or Configuration Setting One or more system settings or configuration elements can be externally controlled by a user.

Submission

Name	Organization	Date	Date release
CAPEC Content Team	The MITRE Corporation	2015-11-09 +00:00

Modifications

Name	Organization	Date	Comment
CAPEC Content Team	The MITRE Corporation	2020-07-30 +00:00	Updated Taxonomy_Mappings
CAPEC Content Team	The MITRE Corporation	2023-01-24 +00:00	Updated Related_Weaknesses