LCRYX Ransomware Winlogon Shell Hijack via wscript.exe Registry Modification

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•7

This rule detects modifications to the Winlogon Shell registry key or a specific 'MyStartupScript' registry Run key. These locations are commonly abused by the LCRYX ransomware to establish persistence via VBScript or script host execution. The rule monitors both EDR registry events and Sysmon event ID 13 for suspicious changes performed by script host processes or targeting these specific persistence locations.