test

:: ============================================================
:: LogonUI impersonation / rogue-process diagnostics
:: All READ-ONLY. Nothing here modifies the system.
:: Run from an elevated (admin) cmd prompt.
:: If intrusion is suspected: image the disk BEFORE running these.
:: Live admin commands mutate prefetch/eventlog/registry access times.
:: ============================================================

:: ---- 1. Running processes: anything drawing a logon-ish window ----
tasklist /v | findstr /i “logon credential”

:: All processes NOT in the normal svchost/LogonUI paths (spot the odd exe)
wmic process get Name,ProcessId,ExecutablePath | findstr /i /v “system32\svchost system32\LogonUI”

:: ---- 2. Winlogon Shell/Userinit hijack ----
:: Expect: Shell = explorer.exe | Userinit = C:\Windows\system32\userinit.exe,
:: Extra exe paths in these values = hijack.
reg query “HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon”

:: ---- 3. Run / RunOnce autostart ----
reg query “HKLM\Software\Microsoft\Windows\CurrentVersion\Run”
reg query “HKCU\Software\Microsoft\Windows\CurrentVersion\Run”
reg query “HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce”

:: ---- 4. Credential Provider registration (rogue provider DLL) ----
:: Compare CLSIDs against a known-good machine. Unknown CLSID = suspect.
reg query “HKLM\Software\Microsoft\Windows\CurrentVersion\Authentication\Credential Providers” /s

:: ---- 5. Image File Execution Options: debugger attached to logonui ----
:: Any “Debugger” value here means something intercepts LogonUI launch.
reg query “HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\logonui.exe”

:: ---- 6. Scheduled tasks + services (persistence) ----
schtasks /query /fo LIST /v | findstr /i “TaskName Task To Run”
sc query type= service state= all | findstr /i “SERVICE_NAME”

:: ---- 7. (optional) confirm the real LogonUI is intact ----
sfc /verifyfile=C:\Windows\System32\LogonUI.exe

:: ============================================================
:: Fastest signal: sections 1, 2, 5.
:: Path outside System32 or a Debugger value = impostor, not corruption.
:: ============================================================