Activity timeline
T1547.004 first appeared in tracked threats on and was most recently reported on . The busiest month was 2026-10 with 3 reports, and 10 of the 10 threats were reported in the twelve months to 2026-11.
How adversaries use it
T1547.004 Winlogon Helper DLL is catalogued by MITRE ATT&CK under the Persistence and Privilege Escalation tactics in the Enterprise matrix, as a sub-technique of T1547 Boot or Logon Autostart Execution. Threadlinqs maps 10 of 3731 tracked threats (0.3%) to it; by severity that is 8 high, 1 medium, 1 low.
Threats that use T1547.004 most often also use T1027 Obfuscated Files or Information (6 threats), T1106 Native API (6 threats), T1140 Deobfuscate/Decode Files or Information (6 threats), T1036.005 Match Legitimate Resource Name or Location (5 threats), T1204.002 Malicious File (5 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed.
6 tracked threat actors appear in the threats that use T1547.004; the most frequent are Daxin operators (2), CylindricalCanine (1), DragonBreath (1), FSB Center 16 (1), LockBit (1).
Mitigations
MITRE ATT&CK lists 2 mitigations for T1547.004.
Data sources
Telemetry that can reveal T1547.004, per MITRE ATT&CK.
- Command — Command Execution
- Module — Module Load
- Process — Process Creation
- Windows Registry — Windows Registry Key Modification
Threat actors using it
Tracked threats
10 tracked threats use T1547.004.
- CTO at NCSC Weekly Summary (week ending July 19, 2026): Russian FSB Center 16 router exploitation, Turla…high
- Daxin Returns: China-linked Backdoor.Daxin kernel rootkit and new Backdoor.Stupig (keyboard-layout DLL in…high
- NEBULA: Seven Fake AI SDK Packages on npm Install a Windows RAT (Modified KNTRAT) That Needs No DLLhigh
- Alleged Ploutus ATM Malware Developer Anibal Canelon Aguirre ('Prometheus'/'The Engineer') Appears in US…high
- Five Venezuelan Nationals Plead Guilty in Failed Kansas ATM Jackpotting Plotlow
- Fake AI Developer Tool Installers Delivering Infostealer via SEO Poisoning and Typosquattinghigh
- Proofpoint AI Era Ransomware Report: 37% of Paying Victims Face Repeat Extortion Demandsmedium
- Multi-Stage Steganographic Loader Delivers Remcos RAT and Rotating Infostealers via .NET Bitmap Resource…high
- Multi-Stage Steganographic Loader Campaign Deploying Remcos RAT and Diverse Stealer Payloads (K7 Labs, June…high
- OpenClaw Hologram Rust Infostealer — Multi-Wave Campaign Abusing Hookdeck Webhook Gateway as C2 Relayhigh
Detection coverage
Threadlinqs maintains 31 detection rules mapped to T1547.004 (SPL 12, KQL 9, Sigma 10). Rule content unlocks with TL Creds on a free account; this page shows counts only.
Parent technique
T1547 Boot or Logon Autostart Execution — 357 tracked threats at the technique level.