LCRYX Ransomware Winlogon Shell and Run Key VBScript Persistence

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•1

This rule detects unauthorized modifications to common Windows persistence registry keys, including 'Run' keys, the 'Winlogon Shell' value, and 'Image File Execution Options' (IFEO) debugger values. These modifications are commonly used by adversaries to establish persistence or intercept process execution.