TrymeLocker Winlogon Shell Registry Hijack for Boot Persistence
Detects unauthorized modifications to the Winlogon Shell or Userinit registry keys. The rule specifically alerts when these keys are updated to point to a binary located outside of standard Windows system directories (System32 or Program Files), which is a common persistence technique used by the TrymeLocker ransomware and other malicious software to execute code at user logon.
YARA-L
