An example implementation of a windows credential provider that is tightly connected with logon system
Fake Windows logon screen to steal passwords
翻译 - 伪造的Windows登录屏幕可窃取密码
WinLogon I/O (LogonUI) Plugin for PowerRemoteDesktop
Assembly code to use for Windows kernel shellcode to edit winlogon.exe ACL
Malware persistent trick. Winlogon registry keys. C++ implementation
Windows 10 Winlogon ShellCode Injection
Type your password in Windows login screen