Winlogon Autostart Values (Userinit / Shell)

Winlogon is the Windows component responsible for the interactive logon process: it handles the secure attention sequence, loads the user’s profile after authentication, and launches the user’s shell. Two registry values under HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon control what it starts, and both are persistence targets — MITRE ATT&CK T1547.004 — Boot or Logon Autostart Execution: Winlogon Helper DLL (and related abuse of the Userinit/Shell values).

The two values

• Userinit — normally C:\Windows\System32\userinit.exe,. Winlogon runs this after a successful logon; userinit.exe in turn runs logon scripts, re-establishes network connections, and then launches the shell. The trailing comma matters: the value is a comma-separated list of programs, all of which are executed.
• Shell — normally explorer.exe. This is the program userinit launches as the user’s desktop shell.

Because both values are parsed as lists, the attack is append, don’t replace. Replacing userinit.exe or explorer.exe outright breaks logon visibly; appending a payload after a comma runs your code alongside the legitimate component:

C:\Windows\System32\userinit.exe,C:\Windows\System32\evil.exe

The payload executes at every interactive logon with the logging-on user’s privileges (or SYSTEM for the winlogon context before user switch, depending on placement). Modifying these HKLM values requires administrator rights.

Why append rather than replace

userinit.exe and explorer.exe are load-bearing: remove them and the victim gets no shell or no profile setup, which is immediately noticeable. The comma-append keeps the machine behaving normally while adding the attacker’s process to the logon chain — the defining trait of a good persistence mechanism.

Related abusable Winlogon values

• Shell can similarly be pointed at (or appended with) an alternate shell.
• Notify / Userinit adjacent keys and the Winlogon GPExtensions/Helper DLLs have been abused for the same purpose, which is why MITRE groups them under T1547.004.

Detection and defense

• Audit HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit and ...\Shell for deviations from the single expected binary (Sysmon EID 13 registry-value-set, or periodic reg query).
• Alert on any second comma-separated entry, any path outside C:\Windows\System32, and any unsigned binary referenced there.
• These keys are among the standard Sysinternals Autoruns logon entries.

Sources

• MITRE ATT&CK — T1547.004 Boot or Logon Autostart Execution: Winlogon Helper DLL

Related

• windows-logon-scripts — the per-user UserInitMprLogonScript variant of logon persistence (T1037.001), no admin required for the current user
• registry-run-keys-and-startup-folder — the more common Run-key / Startup-folder autostart class (T1547.001)
• windows-services — service-based autostart under a service account
• accessibility-feature-hijacking — sibling logon-screen execution primitive (T1546.008)