Winlogon Helper DLL Modified for Persistence
This rule detects network traffic on TCP port 445 (SMB) containing the strings "Winlogon" and "Userinit" (case-insensitive). This pattern is indicative of a potential modification to the Winlogon Helper DLL for persistence, as Winlogon and Userinit are key components in the Windows logon process. An attacker might modify a helper DLL to execute malicious code during system startup.
Suricata
