Winlogon launch values or SafeDllSearchMode rewritten

Siemphony@siemphonymediumT1112unverified

Matches a Sysmon EventID 13 registry write to the two places AN0781 names as its own examples of this technique: the Winlogon launch values (Userinit, Shell and the Notify subkey) and the SafeDllSearchMode value under Session Manager. On `registry_set` the value name is appended to `TargetObject` and the written data lands in `Details`, so the Winlogon leg gates on the key path and then drops the two strings Windows itself stores there — `C:\Windows\system32\userinit.exe,` and `explorer.exe` — through a `Details` filter, since those keys are written during ordinary setup and the default data is what makes a benign write recognisable. Anything else survives the filter, including a second path appended after the comma, which is the shape of the technique. The SafeDllSearchMode leg carries no such filter: any write to that value is worth a look, and the enable-versus-disable distinction would need a `Details` match on Sysmon's DWORD rendering, left off deliberately rather than risk a selector that never fires. The Run keys the analytic also mentions are excluded because the sibling T1547.001 rule already covers them with a payload gate this could not improve on; the Winlogon registry write itself is covered nowhere else, since the T1547.004 rule watches the resulting child process instead of the write. The key list is MITRE's `RegistryKeyPathPatterns` knob populated here with the analytic's own examples; the `ParentProcessAllowList`, `SignatureCheck` and `TimeWindow` knobs are unused, because `registry_set` carries the writing process as `Image` but no parent and no signature fields, and correlating the write with a later execution needs a cross-event join lib/sigma does not model. Sysmon is not installed by default and most shipped Sysmon configurations filter EventID 13 down to an allowlist of keys, so both subtrees have to be in that allowlist or the rule returns zero rows — which reads as quiet when it means blind. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0280, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

DeviceRegistryEvents| where (((RegistryKey contains "\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Userinit" or RegistryKey contains "\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Shell" or RegistryKey contains "\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Notify\\") and not ((RegistryValueData =~ "C:\\Windows\\system32\\userinit.exe," or RegistryValueData =~ "explorer.exe"))) or RegistryKey endswith "\\Control\\Session Manager\\SafeDllSearchMode")

Splunk · SPL

Run this as a search.

index=* (((TargetObject="*\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Userinit*" OR TargetObject="*\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Shell*" OR TargetObject="*\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Notify\\*") AND NOT ((Details="C:\\Windows\\system32\\userinit.exe," OR Details="explorer.exe"))) OR TargetObject="*\\Control\\Session Manager\\SafeDllSearchMode")

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE (((TO_LOWER(registry.path) LIKE "*\\\\microsoft\\\\windows nt\\\\currentversion\\\\winlogon\\\\userinit*" OR TO_LOWER(registry.path) LIKE "*\\\\microsoft\\\\windows nt\\\\currentversion\\\\winlogon\\\\shell*" OR TO_LOWER(registry.path) LIKE "*\\\\microsoft\\\\windows nt\\\\currentversion\\\\winlogon\\\\notify\\\\*") AND NOT ((TO_LOWER(registry.data.strings) == "c:\\windows\\system32\\userinit.exe," OR TO_LOWER(registry.data.strings) == "explorer.exe"))) OR TO_LOWER(registry.path) LIKE "*\\\\control\\\\session manager\\\\safedllsearchmode")

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,registry_set,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <!-- 2 rules: the Sigma condition ORs across different fields,       which one rule cannot express. Any one matching is a hit. -->  <rule id="100000" level="7">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="TargetObject" type="pcre2">(?i)(\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Userinit|\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Shell|\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Notify\\)</field>    <field name="Details" negate="yes" type="pcre2">(?i)(^C:\\Windows\\system32\\userinit\.exe,$|^explorer\.exe$)</field>    <description>Winlogon launch values or SafeDllSearchMode rewritten (1/2)</description>    <mitre>      <id>T1112</id>    </mitre>  </rule>   <rule id="100001" level="7">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="TargetObject" type="pcre2">(?i)\\Control\\Session Manager\\SafeDllSearchMode$</field>    <description>Winlogon launch values or SafeDllSearchMode rewritten (2/2)</description>    <mitre>      <id>T1112</id>    </mitre>  </rule></group>

At a glance

Logsource: registry_set / windows
Level: medium
Category: registry_persistence
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: 420d5e96-ddb2-4149-a25b-701e5aaa6b27

ATT&CKT1112

T1112Modify Registry

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessonregistry persistence

registry persistenceAI draft — unreviewed

01 · What this rule detects

Sysmon EventID 13 registry writes to two specific places: the Winlogon launch values (Userinit, Shell, the Notify subkey) and SafeDllSearchMode under Session Manager. AN0781 names both as its own examples, so the rule detects what MITRE described rather than the whole of T1112 — which as a technique is any registry write and therefore not selectable. Know what an alert will look like to an analyst. The Winlogon values are the registry half of T1547.004 (Winlogon Helper DLL) and SafeDllSearchMode is the enabler for T1574.001. T1112 is the act of modifying the registry; those are what the act is being used for. The T1547.004 rule in this corpus keys on process lineage instead, so there is no duplicate event.

02 · Telemetry you need

category: registry_set / product: windows, from AN0781's first log source. Two prerequisites, both silent when unmet: Sysmon is not installed by default, and most shipped Sysmon configurations filter EventID 13 down to an allowlist of keys. Both subtrees must be in that allowlist or the rule returns zero rows, which reads as quiet when it means blind.
The rule is written in the Sysmon registry_set vocabulary, where the value name is appended to TargetObject and the written data lands in Details. Security 4657 carries the same behaviour but splits those across ObjectName and ObjectValueName, so it needs a field mapping first — enabling Audit Registry alone will not feed this rule. All four backends render it.

03 · How the logic works

Two selections joined by OR. selection_winlogon gates on TargetObject|contains for the three key paths. filter_default_values then drops the two strings Windows itself stores there, C:\Windows\system32\userinit.exe, and explorer.exe, because those keys are written during ordinary setup and the default data is what makes a benign write recognisable. Anything else survives — including a second path appended after the comma, which is the shape of the technique. selection_safedll is an endswith on the value path with no filter at all. The condition is (selection_winlogon and not filter_default_values) or selection_safedll. The key list populates MITRE's RegistryKeyPathPatterns knob with the analytic's own examples; the value names beneath them are the pipeline's. ParentProcessAllowList, SignatureCheck and TimeWindow go unused, because registry_set carries the writing process as Image but no parent and no signature fields, and joining a write to a later execution needs a correlation lib/sigma does not model.

04 · Common false positives

The unfiltered SafeDllSearchMode leg sets the floor. CIS and STIG remediation scripts assert the value as 1 rather than trusting the default, so a scheduled compliance pass matches on every host it touches — the rule's own first false positive calls it the highest-volume source on a managed estate. After that: servicing and sysprep rewriting Userinit and Shell in a spelling the filter does not cover; RDS, kiosk and VDI products that legitimately replace the Shell value; credential providers registering Notify subkeys during a deployment.
level: medium is generous against that first entry. The sibling T1547.001 rule in this corpus went to low on the same wording.

05 · Detection maturity

tier_1: the lowest tier — and it stays there until the rule has been run against real data. Nothing in it has met a log line.
tier_2: costs a week of EventID 13 from your own estate: confirm the two default strings are the spellings your builds actually write, measure how much volume the compliance leg contributes, and set the level from what you observe rather than from this file.

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Gate the second leg on the disable case with Details: 'DWORD (0x00000000)'. Sysmon's DWORD rendering on EventID 13 is stable, so this is not a never-fires risk, and it removes the loudest source outright. Otherwise split SafeDllSearchMode into its own low rule and leave the filtered Winlogon leg at medium.
Widen the Winlogon leg: Taskman, AppSetup, GinaDLL, VmApplet and System sit under the same key and an adversary uses them interchangeably. Extend filter_default_values with the data those values normally carry. Then baseline which processes in your management stack write these keys and suppress by Image.

Declared by the author

Hardening and compliance tooling writing SafeDllSearchMode explicitly to assert its enabled state. CIS and STIG remediation scripts set the value to 1 rather than trusting the default, so a scheduled compliance run matches the second leg on every host it touches, which makes it the highest-volume source of matches on a managed estate.
Operating-system servicing and imaging. A feature update, an in-place upgrade or a sysprep pass rewrites the Winlogon Userinit and Shell values during setup, and any spelling of the default data other than the two strings in the filter — a Userinit value written without its trailing comma, or with a different system path — is not cleared by it.
Remote-desktop, kiosk and VDI products that replace the Winlogon Shell value with their own session host so the user lands in a published application instead of Explorer. This is a supported configuration and on an estate that runs one it is the most common non-default value in that key.
Credential providers, smart-card middleware and endpoint agents that register a Winlogon Notify subkey when they install, which produces a burst of writes across the fleet during a deployment window.

Noise check0 of 6 fired

Fires on none of the 6 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 6 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1112, evaluated against their registry_set events.

Share this rule

/u/siemphony/420d5e96-ddb2-4149-a25b-701e5aaa6b27

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Winlogon launch values or SafeDllSearchMode rewritten

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it