Leveraging registry keys utilized by Winlogon process

The Winlogon process assumes the responsibility of facilitating user logon and logoff operations, managing system starting, and shutdown procedures, as well as implementing screen locking functionality. Malicious actors possess the capability to modify the registry entries utilized by the Winlogon process in order to establish enduring presence.

To apply this persistence strategy, it is necessary to modify the following registry keys:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit

Nevertheless, the successful implementation of this strategy necessitates the possession of local administrator privileges.

A practical example

Let’s observe the practical implementation and demonstration. To begin with, let us develop a harmful application hack.c:

/*
 * hack.c
 * Malware Development for Ethical Hackers...