userinit
Userinit Logon Application
Sets up a person's environment at sign-in, runs logon scripts, then starts the shell.
- Normal Processes
- The person's session
- Open it in the tree
Normal Profile
These are the values a genuine copy shows. Treat any value that differs as a lead.
- Parent
- winlogon.exe (a value that published detection rules check for)Source: Elastic: Unusual Parent-Child Relationship (opens in a new tab)Elastic's rule also accepts dwm.exe and KUsrInit.exe as its parent.
- Path
- System32
C:\Sources: Microsoft Learn: Can't log on to Windows (opens in a new tab), SigmaHQ: System File Execution Location Anomaly (opens in a new tab)Windows\ System32\ userinit.exe - Account
- The person signing inSource: Microsoft Learn: MSGina.dll Features, Userinit.exe activation (opens in a new tab)
- Session
- The person's sessionSource: Microsoft Learn: MSGina.dll Features, Userinit.exe activation (opens in a new tab)
- Instances
- Count copies just after a sign-in and again a minute later, on a clean machine of the same build.
- Starts
- At each sign-inSource: Microsoft Learn: MSGina.dll Features, Userinit.exe activation (opens in a new tab)
- Command Line
- Read it from Security event 4688 or Sysmon event 1 at a sign-in on a clean machine of the same build.
- Signed By
- Check the file with Sigcheck, which reads catalogue signatures too, on a clean machine of the same build.
A value that published detection rules check for.No public source states this value, so compare with a clean machine of the same Windows build.
Why It Matters
Winlogon finds it through the Userinit value and it starts what the Shell value lists, so a changed value runs code at every sign-in. Anything it starts besides the shell and logon scripts deserves a look.
What It Does
Userinit runs in the context of the person who has just signed in. Winlogon starts it at each sign-in from the Userinit value. It restores network connections, applies profile settings and runs logon scripts, then starts the shell programs listed in the Winlogon Shell value, which is Windows Explorer (explorer.exe) unless that value says otherwise. Once the shell is running it exits, so live tools rarely show it. A copy running as SYSTEM, one that started when nobody was signing in, or a child other than the shell and logon scripts is the one to check.
Winlogon finds it through the Userinit value under HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon, whose expected data is C:\windows\system32\userinit.exe. A second program in that value, or in Shell, runs at every sign-in, and the Registry topic's Winlogon Shell and Userinit page shows one added to Userinit.
In creation records the shell's parent is userinit.exe, which Microsoft says starts the shell and then exits. Live tools therefore show explorer.exe with no running parent, or a newer process that reused its process ID (PID). windows.psscan can still find the exited copy, with its exit time.
SigmaHQ flags anything userinit.exe starts other than explorer.exe, the logon scripts netlogon.bat and UsrLogon.cmd, proquota.exe and a few Citrix tools. On Server Core its shell is PowerShell instead.
How Attackers Abuse It
Each line is a way this process is misused, with the page that shows how to spot it.
- A second program added to the Winlogon Userinit value runs at every sign-in, so compare the value with C:\windows\system32\userinit.exe.Wrong Path
- A program added to the Shell value starts under userinit.exe beside explorer.exe, a child SigmaHQ's rule flags.Wrong Parent
Red Flags
Each sign below links to the page that shows how to confirm it.
- Children other than explorer.exe and logon scripts, or a creator other than winlogon.exe.Wrong Parent
- Any folder but System32, or a Userinit value that names another program too.Wrong Path
- Running as SYSTEM, or as any account other than the person signing in.Wrong Account
- A copy that started when nobody was signing in.Unusual Start Time
How to Check It
Each page shows how to check this process, on a running machine and in a memory image.
What Records It
Each record names its log and what must be switched on to get it.
| Record and Where It Lands | What to Read | How to Turn It On |
|---|---|---|
4688 A new process has been created (opens in a new tab)SecurityIt is written on the computer the process ran on. | Under Creator Process Name userinit.exe, each New Process Name should be explorer.exe or a known logon script.Process Trees and Call Chains shows how to read it. | Turn on Audit Process Creation. For the command line, also turn on Include command line in process creation events. |
1 Process creation (opens in a new tab)Microsoft-Windows-Sysmon/OperationalIt is written on any Windows computer running Sysmon. | ParentImage userinit.exe, with each child's Image and CommandLine.Process Trees and Call Chains shows how to read it. | Run Sysmon with ProcessCreate events in its configuration. |
13 RegistryEvent (Value Set) (opens in a new tab)Microsoft-Windows-Sysmon/OperationalIt is written on any Windows computer running Sysmon. | A write to the Userinit or Shell value, with the process that made it. | Run Sysmon with RegistryEvent events in its configuration. |
| Device | Initiating | The Defender for Endpoint sensor on the device |
Hunt It
The same hunt is written for four tools, so pick the one you use. Defender XDR and Sentinel queries are in KQL, which you paste into Advanced hunting in the Defender portal or into Sentinel's Logs page. Splunk queries are in SPL, for its Search page, and Velociraptor queries are in VQL, which you run as a hunt.
Reads the DeviceProcessEvents table in Defender XDR advanced hunting, from devices onboarded to Defender for Endpoint. Logon scripts and a few vendor tools are normal children, so name the ones your estate uses.
// What userinit.exe started other than explorer.exe, and userinit.exe created by anything but winlogon.exe or dwm.exeDeviceProcessEvents| where Timestamp > ago(Sources
- Microsoft Learn: MSGina.dll Features, Userinit.exe activation (opens in a new tab)
- Microsoft Learn: Can't log on to Windows (opens in a new tab)
- Ask the Performance Team blog: WS2008: Terminal Services Architecture (opens in a new tab)
- Elastic: Unusual Parent-Child Relationship (opens in a new tab)
- SigmaHQ: System File Execution Location Anomaly (opens in a new tab)
- SigmaHQ: Uncommon Userinit Child Process (opens in a new tab)