An example implementation of a windows credential provider that is tightly connected with logon system
Fake Windows logon screen to steal passwords
WinLogon I/O (LogonUI) Plugin for PowerRemoteDesktop
Assembly code to use for Windows kernel shellcode to edit winlogon.exe ACL
Windows 10 Winlogon ShellCode Injection
Malware persistent trick. Winlogon registry keys. C++ implementation
Type your password in Windows login screen