Winlogon Userinit/Shell Registry Persistence from AppData or Temp Process
Detects modifications to the 'Userinit' or 'Shell' values within the 'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon' registry key, when initiated by processes running from 'AppData' or 'Temp' directories. These registry keys are commonly abused by malware to achieve persistence upon user logon.
YARA-L
