LCRYX Ransomware Registry Persistence via Winlogon Shell and Run Keys

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•1

Detects LCRYX ransomware establishing persistence by modifying the Winlogon Shell registry key and creating multiple VBScript-based entries in Windows Run keys. The rule monitors for registry modifications targeting known persistence locations with suspicious scripts as values.