# T1547.004 Winlogon Helper DLL

> As of 2026-11-09, T1547.004 (Winlogon Helper DLL) appears in 10 tracked threats, first reported 2026-05-07 and most recently 2026-11-03, with linked actors including Daxin operators, CylindricalCanine, DragonBreath; it most often appears alongside T1027 (Obfuscated Files or Information).

- **Tracked threats:** 10 (8 high, 1 medium, 1 low)
- **First seen:** 2026-05-07
- **Last seen:** 2026-11-03
- **Threat actors:** 6
- **Detection rules:** 31 (counts only; unlock with TL Creds)

## Key facts

- **ID:** T1547.004
- **Framework:** MITRE ATT&CK
- **Tactics:** Persistence, Privilege Escalation
- **Matrix:** Enterprise
- **Parent:** T1547
- **Data as of:** 2026-11-09
- **MITRE:** https://attack.mitre.org/techniques/T1547/004/

## Activity timeline

T1547.004 first appeared in tracked threats on 2026-05-07 and was most recently reported on 2026-11-03. The busiest month was 2026-10 with 3 reports, and 10 of the 10 threats were reported in the twelve months to 2026-11.

## How adversaries use it

T1547.004 Winlogon Helper DLL is catalogued by MITRE ATT&CK under the Persistence and Privilege Escalation tactics in the Enterprise matrix, as a sub-technique of [T1547 Boot or Logon Autostart Execution](https://intel.threadlinqs.com/technique/T1547). Threadlinqs maps 10 of 3731 tracked threats (0.3%) to it; by severity that is 8 high, 1 medium, 1 low.

Threats that use T1547.004 most often also use [T1027 Obfuscated Files or Information](https://intel.threadlinqs.com/technique/T1027) (6 threats), [T1106 Native API](https://intel.threadlinqs.com/technique/T1106) (6 threats), [T1140 Deobfuscate/Decode Files or Information](https://intel.threadlinqs.com/technique/T1140) (6 threats), [T1036.005 Match Legitimate Resource Name or Location](https://intel.threadlinqs.com/technique/T1036.005) (5 threats), [T1204.002 Malicious File](https://intel.threadlinqs.com/technique/T1204.002) (5 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed.

6 tracked threat actors appear in the threats that use T1547.004; the most frequent are [Daxin operators](https://intel.threadlinqs.com/actor/Daxin%20operators) (2), [CylindricalCanine](https://intel.threadlinqs.com/actor/CylindricalCanine) (1), [DragonBreath](https://intel.threadlinqs.com/actor/DragonBreath) (1), [FSB Center 16](https://intel.threadlinqs.com/actor/FSB%20Center%2016) (1), [LockBit](https://intel.threadlinqs.com/actor/LockBit) (1).

## Mitigations

MITRE ATT&CK lists 2 mitigations for T1547.004.

- [M1018 User Account Management](https://attack.mitre.org/mitigations/M1018/)
- [M1038 Execution Prevention](https://attack.mitre.org/mitigations/M1038/)

## Data sources

Telemetry that can reveal T1547.004, per MITRE ATT&CK.

- Command — Command Execution
- Module — Module Load
- Process — Process Creation
- Windows Registry — Windows Registry Key Modification

## Threat actors using it

- [Daxin operators](https://intel.threadlinqs.com/actor/Daxin%20operators) — 2
- [CylindricalCanine](https://intel.threadlinqs.com/actor/CylindricalCanine) — 1
- [DragonBreath](https://intel.threadlinqs.com/actor/DragonBreath) — 1
- [FSB Center 16](https://intel.threadlinqs.com/actor/FSB%20Center%2016) — 1
- [LockBit](https://intel.threadlinqs.com/actor/LockBit) — 1
- [Nitrogen](https://intel.threadlinqs.com/actor/Nitrogen) — 1

## Tracked threats

10 tracked threats use T1547.004.

- [CTO at NCSC Weekly Summary (week ending July 19, 2026): Russian FSB Center 16 router exploitation, Turla…](https://intel.threadlinqs.com/threat/TL-2026-5143) — high — 2026-11-03
- [Daxin Returns: China-linked Backdoor.Daxin kernel rootkit and new Backdoor.Stupig (keyboard-layout DLL in…](https://intel.threadlinqs.com/threat/TL-2026-4700) — high — 2026-10-29
- [NEBULA: Seven Fake AI SDK Packages on npm Install a Windows RAT (Modified KNTRAT) That Needs No DLL](https://intel.threadlinqs.com/threat/TL-2026-3049) — high — 2026-10-08
- [Alleged Ploutus ATM Malware Developer Anibal Canelon Aguirre ('Prometheus'/'The Engineer') Appears in US…](https://intel.threadlinqs.com/threat/TL-2026-2939) — high — 2026-10-05
- [Five Venezuelan Nationals Plead Guilty in Failed Kansas ATM Jackpotting Plot](https://intel.threadlinqs.com/threat/TL-2026-2275) — low — 2026-08-31
- [Fake AI Developer Tool Installers Delivering Infostealer via SEO Poisoning and Typosquatting](https://intel.threadlinqs.com/threat/TL-2026-1845) — high — 2026-08-03
- [Proofpoint AI Era Ransomware Report: 37% of Paying Victims Face Repeat Extortion Demands](https://intel.threadlinqs.com/threat/TL-2026-1710) — medium — 2026-07-22
- [Multi-Stage Steganographic Loader Delivers Remcos RAT and Rotating Infostealers via .NET Bitmap Resource…](https://intel.threadlinqs.com/threat/TL-2026-0939) — high — 2026-06-25
- [Multi-Stage Steganographic Loader Campaign Deploying Remcos RAT and Diverse Stealer Payloads (K7 Labs, June…](https://intel.threadlinqs.com/threat/TL-2026-0896) — high — 2026-06-21
- [OpenClaw Hologram Rust Infostealer — Multi-Wave Campaign Abusing Hookdeck Webhook Gateway as C2 Relay](https://intel.threadlinqs.com/threat/TL-2026-0480) — high — 2026-05-07

## Related CVEs

CVEs referenced by the tracked threats that use T1547.004, most frequent first.

- [CVE-2018-13379](https://intel.threadlinqs.com/cve/CVE-2018-13379)
- [CVE-2020-0796](https://intel.threadlinqs.com/cve/CVE-2020-0796)
- [CVE-2023-0669](https://intel.threadlinqs.com/cve/CVE-2023-0669)
- [CVE-2023-27350](https://intel.threadlinqs.com/cve/CVE-2023-27350)
- [CVE-2023-4966](https://intel.threadlinqs.com/cve/CVE-2023-4966)
- [CVE-2023-4967](https://intel.threadlinqs.com/cve/CVE-2023-4967)
- [CVE-2026-40639](https://intel.threadlinqs.com/cve/CVE-2026-40639)

## Detection coverage

Threadlinqs maintains 31 detection rules mapped to T1547.004 (SPL 12, KQL 9, Sigma 10). Rule content unlocks with TL Creds on a free account; this page shows counts only.

31 detection rules (SPL/KQL/Sigma), unlock with TL Creds: https://threadlinqs.com/tl-creds

## Parent technique

[T1547 Boot or Logon Autostart Execution](https://intel.threadlinqs.com/technique/T1547) — 357 tracked threats at the technique level.

## Links

- Canonical page: https://intel.threadlinqs.com/technique/T1547.004
- All techniques: https://intel.threadlinqs.com/techniques
- Full detection coverage and IOCs unlock per threat with TL Creds (https://threadlinqs.com/tl-creds); MCP for AI agents (Purple): https://intel.threadlinqs.com/mcp