TrymeLocker Winlogon Shell Hijack via Registry Modification (Sysmon)

Ibrahim Saud@tektrix

•updated Jun 28, 2026•1•0•2

Detects modification of the Windows Registry 'Shell' value within the Winlogon key to an executable other than 'explorer.exe'. This technique is commonly used by malware, such as TrymeLocker, to achieve persistence by replacing or augmenting the default Windows shell with a malicious payload that executes upon every user login.