winlogon.exe: Windows Processes

Normal Profile

These are the values a genuine copy shows. Treat any value that differs as a lead.

Parent: smss.exe (a value that published detection rules check for)Source: Elastic: Unusual Parent-Child Relationship (opens in a new tab)Live tools and windows.pstree read only a parent PID, which can name an ended process or a newer one that reused it, while creation records name smss.exe.
Path: System32 (a value that published detection rules check for)C:\Windows\System32\winlogon.exeSources: Velociraptor: Windows.Attack.UnexpectedImagePath (opens in a new tab), SigmaHQ: System File Execution Location Anomaly (opens in a new tab)
Account: Read it from the process token on a clean machine of the same build, with Process Explorer live or windows.getsids in memory.
Session: Each session but session 0Source: Microsoft Learn: Custom Login Experiences: Credential Providers in Windows Vista (opens in a new tab)
Instances: One per sessionSources: Microsoft Learn: Custom Login Experiences: Credential Providers in Windows Vista (opens in a new tab), Ask the Performance Team blog: WS2008: Terminal Services Architecture (opens in a new tab)Each new session, at the console or over Remote Desktop, starts its own copy.
Starts: Compare each copy's start with the last full boot and with each sign-in, on a clean machine of the same build.
Command Line: Read it elevated with Get-CimInstance Win32_Process on a clean machine of the same build.
Signed By: Check the file with Sigcheck, which reads catalogue signatures too, on a clean machine of the same build.

A value that published detection rules check for.No public source states this value, so compare with a clean machine of the same Windows build.

Why It Matters

It answers the secure attention sequence, the keys that begin a sign-in (Ctrl+Alt+Del by default), and starts what runs at each sign-in, so a changed Shell or Userinit value runs code for everyone who signs in. Microsoft treats any outbound connection from it as highly suspicious.

What It Does

Winlogon performs interactive sign-in, the sign-in a person makes at the screen, for a logon session. It creates the desktops for the window station, registers the secure attention sequence and, once that sequence arrives, starts LogonUI.exe to show the sign-in tiles on the secure desktop. It passes the credentials collected on that secure desktop to the Local Security Authority, then starts the program the Userinit value names, userinit.exe, which sets up the person's session and starts the shell. A copy outside System32, a second copy in one session, or a command prompt it starts at the sign-in screen is the one to look at.

At sign-in it reads the Shell and Userinit values under HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon, whose expected data are explorer.exe and C:\windows\system32\userinit.exe. Userinit then starts the shell, so a program added to either value runs for everyone who signs in. Compare both with these defaults.

Microsoft lists winlogon.exe among the built-in critical processes, whose unexpected end stops Windows with bug check 0xEF, so a copy that started long after its session began is not the original. Each session but session 0, where Windows runs its own services, has one copy, started by that session's own smss.exe, so creation records name smss.exe. A live tool reads only a parent PID, the process ID of the process that started it, which can name an ended process or a newer one that reused it, so compare start times.

SigmaHQ flags any connection winlogon.exe starts to a public address, and Microsoft's incident responders treat any outbound connection from it as highly suspicious. A shell under winlogon.exe at the sign-in screen, with an accessibility tool such as sethc.exe or Utilman.exe on its command line, is an accessibility backdoor. Who Starts What lists it with the other ways a program is started.

winlogon.exe starts only a few programs, and each one at a known moment. This table lists them with the source that says each is normal, so a child outside it, or one at the wrong moment, stands out.

What winlogon.exe Starts, and What It Should Never Start

Child	When It Starts	Normal, and Who Says So
`LogonUI.exe`	After a secure attention sequence, to show the sign-in tiles	Yes (Microsoft Learn)
`userinit.exe`	At each sign-in, from the Userinit value	Yes (Microsoft, Elastic)
`dwm.exe`	Not documented (it composes the desktop)	Yes (Elastic)
`fontdrvhost.exe`	Not documented	Yes (Elastic)
`cmd.exe, powershell.exe`	At the sign-in screen, with an accessibility tool such as sethc.exe or Utilman.exe on the command line	No, it is an accessibility backdoor (SigmaHQ, Elastic)

How Attackers Abuse It

Each line is a way this process is misused, with the page that shows how to spot it.

A prompt winlogon.exe starts at the sign-in screen, with sethc.exe or Utilman.exe on its command line, is an accessibility backdoor.Wrong Parent
Code injected into winlogon.exe can show as connections it starts to public addresses, which Microsoft treats as highly suspicious.Network Connections That Should Not Exist

Red Flags

Each sign below links to the page that shows how to confirm it.

A creator other than smss.exe in creation records, or a shell it starts at the sign-in screen.Wrong Parent
Any folder but C:\Windows\System32.Wrong Path
Any connection it starts to a public address. Microsoft treats outbound connections from it as highly suspicious.Network Connections That Should Not Exist
More than one copy in a session, or any copy in session 0.Extra or Missing Instances
A copy that started long after its session began, since a critical process cannot restart without stopping Windows.Unusual Start Time

How to Check It

Each page shows how to check this process, on a running machine and in a memory image.

What Records It

Each record names its log and what must be switched on to get it.

Record and Where It Lands	What to Read	How to Turn It On
4688 `A new process has been created` (opens in a new tab)`Security`It is written on the computer the process ran on.	For a New Process Name ending in winlogon.exe, the Creator Process Name should be smss.exe and the path System32.Process Trees and Call Chains shows how to read it.	Turn on Audit Process Creation. For the command line, also turn on Include command line in process creation events.
1 `Process creation` (opens in a new tab)`Microsoft-Windows-Sysmon/Operational`It is written on any Windows computer running Sysmon.	Image, ParentImage and User for each copy. Sysmon logs from early in the boot, so the first copy is there too.Process Trees and Call Chains shows how to read it.	Run Sysmon with ProcessCreate events in its configuration.
`DeviceProcessEvents` (opens in a new tab)Each row is a process creation or a related event, naming the new process, the process that created it and that creator's parent.Defender XDR, advanced hunting	FolderPath, InitiatingProcessFileName, AccountName and CreatedProcessSessionId for each copy.	The Defender for Endpoint sensor on the device
3 `Network connection` (opens in a new tab)`Microsoft-Windows-Sysmon/Operational`It is written on any Windows computer running Sysmon.	A connection whose Image is winlogon.exe and whose destination is a public address, which is the case SigmaHQ flags.Network Connections shows how to read it.	Run Sysmon with NetworkConnect events in its configuration. They are off by default.
`DeviceNetworkEvents` (opens in a new tab)Each row is a network connection or a related event, tied to the process that made it.Defender XDR, advanced hunting	Rows where InitiatingProcessFileName is winlogon.exe and RemoteIP is a public address.	The Defender for Endpoint sensor on the device

Hunt It

The same hunt is written for four tools, so pick the one you use. Defender XDR and Sentinel queries are in KQL, which you paste into Advanced hunting in the Defender portal or into Sentinel's Logs page. Splunk queries are in SPL, for its Search page, and Velociraptor queries are in VQL, which you run as a hunt.

Sees It DirectlyDeviceProcessEvents

Reads the DeviceProcessEvents table in Defender XDR advanced hunting, from devices onboarded to Defender for Endpoint. Before you read no rows as clean, check that it recorded the genuine copy at a recent boot or sign-in. A hit is a lead, so check the file's signer and where it came from before you call it malicious.

KQLDefender XDR, Advanced hunting

// winlogon.exe outside C:\Windows\System32, or created by anything but smss.exeDeviceProcessEvents| where Timestamp > ago(30d)| where FileName =~ "winlogon.exe"| where not(FolderPath matches regex @"(?i)^C:\\Windows\\System32(\\winlogon\.exe)?$")    or InitiatingProcessFileName !in~ ("smss.exe")| project Timestamp, DeviceName, FolderPath, ProcessCommandLine, AccountName, CreatedProcessSessionId, InitiatingProcessFileName, InitiatingProcessFolderPath

Changes by Version

This process has changed between versions, so read a machine against its own.

Windows Vista Credential providers replaced GINA, the logon DLL that Winlogon loaded into its own process.
Windows Vista Session 0 stopped hosting interactive sign-in, so it has no winlogon.exe, while every other session has one.

Check It in the Registry: Winlogon Shell and Userinit Winlogon Notify, Taskman and AppSetup
Read with Active Directory: Credentials on a Running Machine What a sign-in through Winlogon leaves in LSASS for single sign-on.