TrymeLocker Winlogon Shell/Userinit Registry Modification for Persistence
Detects modifications to the Winlogon Shell or Userinit registry values, which are critical autostart locations often abused for persistence. The rule filters out legitimate system processes and flags values that point to suspicious locations such as AppData, Temp, or ProgramData, or that do not point to the expected explorer.exe binary.
SentinelOne
